Application Store
Monthly
Sensitive information disclosure in Dell Application Store versions prior to 26.05.0.7 allows an authenticated low-privileged local attacker to read data that should be protected because a critical resource has incorrect permissions. Exploitation is local, requires a non-trivial condition, and is assessed as low urgency; no public exploit identified at time of analysis. Dell's fixed release is 26.05.0.7, documented in DSA-2026-411.
Unauthenticated arbitrary code execution in Dell Application Store affects every release prior to 26.05.0.7, reachable by an attacker who shares the same local network segment as the host. The root cause is a critical function that performs no authentication check (CWE-306), so an attacker with adjacent access (shared LAN or Wi-Fi broadcast domain, per AV:A) can invoke it without credentials or user interaction, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the adjacency requirement keeps it off routed/internet attack paths and out of mass-scanning reach, but it is a credible priority for environments running the component on flat or untrusted Layer 2 networks.
An uncontrolled search path element in Dell Application Store (CWE-427) lets a local, low-privileged user plant a malicious library or executable in a location the installer or updater searches, so the higher-privileged Application Store process loads attacker code and yields elevation of privilege plus arbitrary code execution. All builds prior to 26.05.0.7 are affected; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), meaning the attacker must already hold a local account or code-execution primitive on the host, no victim interaction is required, and impact is confined to that machine. There is no remote attack surface here - it is a post-compromise or insider escalation step rather than an entry vector - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.
Sensitive information disclosure in Dell Application Store versions prior to 26.05.0.7 allows an authenticated low-privileged local attacker to read data that should be protected because a critical resource has incorrect permissions. Exploitation is local, requires a non-trivial condition, and is assessed as low urgency; no public exploit identified at time of analysis. Dell's fixed release is 26.05.0.7, documented in DSA-2026-411.
Unauthenticated arbitrary code execution in Dell Application Store affects every release prior to 26.05.0.7, reachable by an attacker who shares the same local network segment as the host. The root cause is a critical function that performs no authentication check (CWE-306), so an attacker with adjacent access (shared LAN or Wi-Fi broadcast domain, per AV:A) can invoke it without credentials or user interaction, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the adjacency requirement keeps it off routed/internet attack paths and out of mass-scanning reach, but it is a credible priority for environments running the component on flat or untrusted Layer 2 networks.
An uncontrolled search path element in Dell Application Store (CWE-427) lets a local, low-privileged user plant a malicious library or executable in a location the installer or updater searches, so the higher-privileged Application Store process loads attacker code and yields elevation of privilege plus arbitrary code execution. All builds prior to 26.05.0.7 are affected; the CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), meaning the attacker must already hold a local account or code-execution primitive on the host, no victim interaction is required, and impact is confined to that machine. There is no remote attack surface here - it is a post-compromise or insider escalation step rather than an entry vector - and no public exploit code has been identified at time of analysis, with no CISA KEV listing.