Dell ThinOS 10 EUVD-2026-86394

Requires the attacker to hold an adjacent-network position (AV:A) - same Layer-2 broadcast domain / VLAN or Wi-Fi segment as the Dell ThinOS 10 client - from which to intercept and machine-in-the-middle a TLS connection whose server certificate the client fails to properly validate (CWE-295). No authentication (PR:N) and no user interaction (UI:N) are needed, but exploitation is bounded by network adjacency: an attacker on a routed/remote network cannot reach it, and network segmentation that isolates thin clients from untrusted hosts sharply reduces exposure. Affected configurations are Dell ThinOS 10 endpoints running a SecurityAddon build prior to 2605.10.2766_T10.

This is a genuine elevated-priority issue but not an emergency. The CVSS 3.1 base score of 8.3 (High) is driven by an adjacent-network attack vector (AV:A), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and high confidentiality/integrity impact (C:H/I:H) with low availability impact (A:L). The single most important limiting signal is AV:A - the attacker must be on the same logical adjacent network (same L2 segment / broadcast domain or otherwise able to intercept traffic), which materially constrains reach versus a routable AV:N flaw. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active exploitation or automated weaponization; the classic MITM certificate-validation weakness is well understood conceptually but no PoC is confirmed here. Signals are internally consistent (Dell's vector matches the CWE-295 improper-certificate-validation description of a protection-mechanism bypass), so there is no CVSS-vs-description conflict to flag. Net: prioritize patching for fleets where thin clients share untrusted or shared L2 segments, but the adjacency requirement and absence of KEV/EPSS/PoC signals make widespread opportunistic exploitation unlikely.

An attacker positioned on the same adjacent network segment as a Dell ThinOS 10 thin client (for example a rogue device or compromised host on the same VLAN/Wi-Fi) intercepts a TLS connection the client makes to a broker or backend service. Because the client improperly validates the server certificate, the attacker presents a forged or mismatched certificate that is accepted, enabling a machine-in-the-middle that bypasses the intended protection mechanism and grants unauthorized access to the session data. No public exploit code is identified at time of analysis, and no authentication or user interaction is required.