Dell
Monthly
Local privilege escalation in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows a low-privileged local user to gain elevated privileges and, in some exploitation paths, to disrupt the service and cause denial of service. The victim must already have an authenticated local session on the affected machine (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0); attack complexity is high, indicating a non-deterministic race or specific runtime state is required rather than a reliable one-shot trigger, and no user interaction is needed. No public exploit code has been identified at time of analysis, no CISA KEV listing is present, and no EPSS score was provided, so this should be treated as a moderate-priority local hardening issue rather than an urgent remote-exploitation emergency.
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Dell Terraform Provider for Redfish versions before 1.6.2 exposes Redfish BMC traffic, including credentials, to man-in-the-middle interception because TLS certificate verification is unconditionally disabled in its base HTTP transport. This critical-severity flaw (CVSS 9.0) allows an unauthenticated remote attacker who occupies a MITM position to capture or alter sensitive Redfish API communications, though exploitation is condition-gated to active provider-to-BMC traffic windows and is materially lower risk on trusted, isolated management segments. No public exploit identified at time of analysis; Dell recommends upgrading to 1.6.2.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-privileged user to bypass authorization by manipulating a user-controlled key (object/resource identifier) that the application trusts, escalating to a higher-privileged role with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only installations running versions below the patched build are affected; the vulnerability is not remotely exploitable without credentials, requires no victim interaction, and per available intelligence there is no public exploit code and no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none, EPSS 0.18% / 6th percentile). The independence assessment rates this a credible but not emergency-level priority: the attacker must first hold valid low-privilege credentials, but once inside can turn a benign identifier into an elevation-of-privilege primitive.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allow a low-privileged, authenticated remote attacker to move from limited access to full control of the affected host. Exploitation requires an existing low-privileged foothold on a network-reachable Policy Manager instance running a version prior to the fixed release; no victim interaction is needed and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (24th percentile), so signals are mostly consistent and indicate a serious but not emergency-grade issue, with realistic risk concentrated where Policy Manager is exposed to untrusted networks or low-privilege credentials are easy to obtain.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. CVSS 3.1 scores it 8.2 with a changed scope and high confidentiality, integrity and availability impact, but no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incorrectly secured critical resource to gain higher privileges (CVSS 8.2, CWE-732). Exploitation requires local access, a valid low-privileged account, and user interaction-most plausibly an administrator running the updater after malicious content has been staged in a writable location-so remote or unauthenticated attack is not possible. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
OS command injection in Dell OpenManage Integration for Microsoft Windows Admin Center (versions prior to 3.7.0) allows an authenticated low-privileged remote attacker to execute arbitrary commands on the management host, compromising confidentiality, integrity, and availability. The vulnerability requires network access (AV:N) and low privileges (PR:L) but no user interaction (UI:N), and it is only reachable where the Dell OpenManage Integration extension is installed. No public exploit code or active exploitation is currently identified; the vendor has released a security advisory (DSA-2026-442) with a fix in version 3.7.0.
Missing authentication in the csm-authorization-tenant gRPC service (TenantService) shipped with Dell Container Storage Modules (CSM) allows an unauthenticated attacker on the adjacent network to create tenant entities, inject roles across tenant boundaries, and modify storage access-control flags on any deployment running CSM authorization prior to 1.18.0. The flaw is rated CVSS 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflecting high integrity impact with no authentication and no user interaction required, though it is only reachable from an adjacent network segment rather than the public internet. There is no public exploit identified at time of analysis and no CISA KEV listing; multiple signals point to a moderate, not top-tier, priority, with exposure concentrated in clusters that actually deploy the CSM authorization module and do not segment its gRPC control plane from untrusted pods or hosts.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Predictable, insufficiently random values in Dell Container Storage Modules (CSM) before 1.18.0 allow an unauthenticated attacker with local access to a host or Kubernetes node to tamper with information and degrade availability (CVSS 7.7, C:N/I:H/A:H). The flaw cannot be triggered over the network - it requires local presence on a CSM-managed node - and needs no user interaction, while confidentiality is unaffected. No public exploit code has been identified at time of analysis, and the local-access prerequisite keeps this a moderate-priority issue rather than a high-urgency one despite its High base score.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server component - all versions prior to 1.18.0 - allows an attacker holding an adjacent network position and performing a man-in-the-middle interception of the proxy-server's TLS traffic to impersonate the storage backend and capture storage backend administrator credentials. No authentication or user interaction is required, and the CVSS 3.1 score of 8.2 reflects high confidentiality and integrity impact with scope change, since compromise of the proxy-server crosses into the storage array's administrative domain. Exploitation is constrained by high attack complexity (AC:H) and the adjacency requirement, which keep the flaw off the routable internet; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, making this a credible but conditional priority for environments where CSM proxy-server traffic is not isolated to a trusted segment.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-privileged local user raise their privileges by abusing incorrectly assigned permissions on a critical resource. The flaw is not remotely or unauthenticated-exploitable: an attacker must already hold local, low-privileged access to the host (PR:L, AV:L), and exploitation additionally depends on a high-complexity precondition such as a race condition or a specific system state (AC:H) plus the mis-permissioned resource being present in the deployed configuration. No user interaction is required, and no public exploit identified at time of analysis; Dell has released a fix in 5.34.00.16 via advisory DSA-2026-385.
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who already occupies an adjacent-network position intercept, forge or tamper with protected connections, exposing sensitive information and defeating protection mechanisms. Affected builds are all versions prior to 5.34.00.16 and prior to 5.36; the CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates exploitation needs no credentials and no user interaction, but does require the attacker to be on the same or an adjacent network segment as the SCG Policy Manager rather than reaching it across the internet. No public exploit code and no active exploitation have been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is negligible at 0.08% (0th percentile), so risk is driven by network positioning and management-plane exposure rather than mass exploitation.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Incorrectly assigned permissions on critical resources shipped with Dell Trusted Device Client (all versions prior to 8.1.359.0) let a low-privileged local user write to or modify files, directories, registry keys, or service configuration belonging to the agent, enabling tampering with trusted-device state and, per the vendor vector, disclosure of sensitive data (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation is strictly local: it requires an existing interactive or session-level account on the Windows endpoint and the underlying CWE-732 misconfiguration; there is no remote or unauthenticated vector, and no code execution or availability impact is claimed. Our independent assessment narrows the confidentiality component to Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) and stresses that the realistic outcome is tampering with client data and configuration rather than host compromise. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor advisory is the only reference.
Improper authorization in Dell Rugged Control Center (RCC) builds prior to 5.2.206 allows a low-privileged local user to escalate privileges on an affected rugged Dell endpoint. The vendor rates this CVSS 8.1 with a local attack vector, low privileges required, scope change, and high integrity and availability impact (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H), meaning an attacker or malware must already hold a foothold on the specific rugged device - it is not remotely or unauthenticated exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Dell has released a fixed build (5.2.206) via advisory DSA-2026-410.
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.2766_T10) allows an unauthenticated remote attacker who can reach the exposed function to gain unauthorized access to it, reflected in a CVSS:3.1 base score of 8.6 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, where the high integrity impact dominates and confidentiality and availability effects are limited. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine priority signal rather than a confirmed-exploited emergency. The main practical constraint on exploitation is network reachability: ThinOS endpoints are typically deployed inside enterprise/VDI network segments rather than exposed to the public internet, so meaningful risk arises when an attacker already has a foothold on a segment from which the affected service can be reached.
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 lets an adjacent-network attacker bypass a protection mechanism and gain unauthorized access to client communications and credentials. The flaw is rated CVSS 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), meaning no authentication or user interaction is required, but the attacker must already sit on the same Layer-2 segment, VLAN, or Wi-Fi network as the thin client to position themselves for a machine-in-the-middle interception. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine elevated-priority issue rather than an emergency - the practical risk is driven by how flat and trusted the thin-client network segment is.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Local privilege escalation in Dell Command | Monitor (DCM) versions prior to 10.13.2 allows an authenticated low-privileged Windows user to gain elevated privileges by abusing an incorrectly secured resource that the DCM agent accesses at higher integrity. Successful exploitation requires an existing local foothold on the endpoint, but needs no user interaction and changes scope (S:C) because the attacker leverages DCM's elevated context to impact the wider host - confidentiality and integrity are both rated High, availability is not. There is no remote or unauthenticated attack path, and no public exploit identified at time of analysis; Dell has published a fix in the DSA-2026-380 advisory, making this a credible but not urgent patching priority for fleets running older DCM agents.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
Code execution can be achieved through an uncontrolled search path in Dell Server Update Utility (SUU) and its bundled Driver Packs for Windows and Linux at all versions prior to 26.07.01, which load libraries from locations an attacker may be able to control (CWE-427). Exploitation is local and not remotely reachable: per the CVSS vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) an attacker must already hold low-privileged local access, must be able to plant a malicious library in a directory the utility searches, and must wait for a higher-privileged user or administrator to subsequently run SUU so the planted code loads with that user's privileges. No public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV); Dell has released a fixed version, 26.07.01, via advisory DSA-2026-422.
Elevation of privilege in Dell SmartFabric Manager versions prior to 2.2.1 allows a low-privileged, authenticated remote attacker to bypass data authenticity verification and gain full control of the affected host, with the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicating total loss of confidentiality, integrity, and availability. Exploitation requires an existing low-privilege session plus network reachability to the SmartFabric Manager management interface and the ability to inject data the product fails to authenticate (CWE-345); it is not automatable per the SSVC assessment, and no public exploit code has been identified at time of analysis. EPSS is low at 0.20% (10th percentile), and CISA KEV does not list this CVE, so mass opportunistic exploitation is not currently indicated, though a vendor patch is available in 2.2.1.
Information disclosure in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allows a locally authenticated low-privileged attacker to read sensitive data, potentially including credentials or configuration details, with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 7.3) requires local access and an existing low-privileged account, but no user interaction and low complexity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Dell OpenManage Server Administrator versions prior to 11.1.0.3 lets remote, unauthenticated attackers who can induce a user interaction coerce the management agent into issuing requests to attacker-chosen internal or external targets, exposing sensitive internal services such as management APIs and cloud metadata endpoints. The flaw (CWE-918) is rated CVSS 3.1 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), with the scope-change and confidentiality-high components reflecting that forged traffic escapes the OMSA trust boundary while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and real-world impact depends on the OMSA web interface being network-reachable and the managed host having line-of-sight to valuable internal targets.
Elevation of privilege in Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3 lets a network-positioned attacker who already holds high privileges escalate to full control of the managed node, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.2). The underlying weakness is improper privilege management (CWE-269) reachable over the OMSA network management interface with low complexity and no user interaction, affecting Windows managed-node patch installations as well as managed nodes on RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04. No public exploit has been identified at time of analysis; the dominant limiting factor is the PR:H precondition, meaning anonymous or low-privileged remote attackers cannot trigger this issue.
Privilege escalation and information tampering in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allow a low-privileged authenticated remote attacker to modify data and gain unauthorized access through improper privilege management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network reachability with low attack complexity, requiring only low privileges and no user interaction, and resulting in high integrity and availability impact with no confidentiality loss. No public exploit identified at time of analysis.
Stack-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an attacker who already holds high privileges on the OMSA service to achieve remote code execution over the network. Exploitation is constrained by the CVSS PR:H prerequisite-only compromised administrative accounts, malicious insiders, or chaining from another privilege-granting flaw can trigger it-but no user interaction is required and attack complexity is low. No public exploit code or CISA KEV active exploitation is identified in the available intelligence.
Unauthenticated path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 lets a remote attacker read arbitrary files from the managed node's filesystem. The flaw is reachable over the network with no credentials, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but impact is confidentiality-only: an attacker can exfiltrate files, not modify them or disrupt the service. All shipped managed-node platforms are affected (Windows patch bundle, RHEL 8.10, RHEL 9.4, SLES 15, Ubuntu 22.04); no public exploit identified at time of analysis and the vulnerability has not been confirmed actively exploited (CISA KEV), so practical risk tracks directly with how broadly the OMSA management interface is reachable.
Hard-coded credentials in Dell OpenManage Server Administrator (OMSA) managed-node builds before 11.1.0.3 let an unauthenticated remote attacker reach the management service and log in with credentials baked into the product, bypassing authentication entirely (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Affected builds are the Windows managed-node patch package and the RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed-node packages; exploitation needs only network reachability to the OMSA service, but in practice those interfaces are usually confined to internal management networks, so internal and lateral exposure is the more realistic path. Exploitation status: no public exploit identified at time of analysis (CISA SSVC records Exploitation: none), and EPSS is low at 0.31% (24th percentile); a vendor patch exists in version 11.1.0.3, which removes the condition outright, so the residual risk is driven by unpatched, network-exposed OMSA instances rather than by observed attack activity.
Use of a hard-coded cryptographic key in Dell OpenManage Server Administrator (OMSA) Managed Node builds prior to 11.1.0.3 means an unauthenticated remote attacker who can reach the OMSA management service may recover the statically embedded key shared by every installation and leverage it to bypass authentication for unauthorized access to managed nodes. Affected builds are the Windows managed-node patch and the RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04 packages, all of which are fixed in vendor version 11.1.0.3. Exploitation has not been confirmed in the wild (no CISA KEV listing), CISA's SSVC decision framework rates the issue as not automatable with no observed exploitation, and EPSS is low at 0.38% (32nd percentile), while the assessed CVSS of 9.8 reflects full confidentiality, integrity and availability impact if the flaw is successfully abused.
Remote code execution in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3: a heap-based buffer overflow (CWE-122) that an attacker holding administrator-level privileges on the OMSA service can trigger over the network without user interaction, gaining code execution on the managed host with full confidentiality, integrity, and availability impact. The flaw scores 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and affects Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed nodes. No public exploit code and no confirmed active exploitation were identified at time of analysis; the high-privilege prerequisite keeps this a privileged-user-to-code-execution escalation rather than a pre-authentication internet-facing exploit, with risk rising where OMSA is exposed to untrusted networks or chained after an authentication bypass such as CVE-2026-81475 in the same DSA-2026-403 bundle.
Unauthenticated remote OS command injection in Dell OpenManage Server Administrator (OMSA) managed-node builds prior to 11.1.0.3 allows a network-reachable attacker to run arbitrary operating-system commands on the host, yielding full confidentiality, integrity, and availability impact (CVSS 8.1, C:H/I:H/A:H, CWE-78). Affected deployments include the Windows managed-node patch build and the managed-node packages for RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04; the vendor rates attack complexity as high (AC:H), so successful exploitation hinges on a specific non-default condition, timing, or crafted-input constraint rather than a single trivial request. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, while hosts already updated to 11.1.0.3 are not affected.
Unauthenticated remote code execution is possible against Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3, where a critical management function can be invoked without any authentication check (CWE-306). Affected deployments include the Windows managed-node patch plus managed-node builds for RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04, and an attacker who can reach the OMSA management interface from the network needs no credentials and no user interaction (CVSS 8.1, PR:N/UI:N), though the AC:H rating indicates the exploit path depends on conditions outside the attacker's control and is not a simple one-shot request. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so real-world risk is currently gated mainly by whether OMSA is exposed beyond a trusted management VLAN rather than by known exploitation.
Information disclosure in Dell OpenManage Server Administrator (OMSA) managed nodes running releases prior to 11.1.0.3, caused by reliance on a broken or risky cryptographic algorithm (CWE-327) that can expose protected data in transit. All managed-node platforms in scope are affected - the Windows managed-node patch build as well as the RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed-node packages. The CVSS v3.1 vector carries PR:N (unauthenticated) with network reachability, but our independent assessment raises attack complexity to High because recovering data from a flawed cryptographic algorithm requires the attacker to already observe or intercept the affected traffic (an on-path/man-in-the-middle position) rather than simply sending a request; impact is confidentiality-only. There is no public exploit code and no confirmed active exploitation, and the EPSS score is low at 0.18% (8th percentile), so this is a moderate-priority patching item rather than an emergency. Vendor-released patched builds are available in version 11.1.0.3 per Dell DSA-2026-403.
A heap-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an authenticated local attacker with low privileges to corrupt process memory and escalate to full root/SYSTEM-level control of the managed node. Only hosts with the OMSA managed-node component installed and running are affected, across Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 packages. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) confirms a local elevation-of-privilege primitive requiring an existing local account but no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory's 'network access' title does not imply an unauthenticated remote path for this CVE.
Unauthenticated remote attackers can bypass security protection mechanisms in Dell OpenManage Server Administrator Managed Node running versions prior to 11.1.0.3 by supplying externally controlled input that dictates which class or code path is instantiated (CWE-470, unsafe reflection). The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N) with integrity-only impact - no confidentiality or availability loss - and remediation is straightforward because Dell has shipped a fixed build, leaving network reachability to the OMSA management service as the practical gating factor. Exploitation status: no public exploit identified at time of analysis; CISA KEV does not list this CVE, EPSS is 0.37% (31st percentile), and CISA SSVC rates exploitation as 'none' with 'partial' technical impact, making this a genuine but not top-tier priority.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting versions prior to 26.07.03, allows an unauthenticated attacker on the same local network segment (AV:A) to corrupt stack memory and achieve arbitrary code execution on the affected host with full confidentiality, integrity, and availability impact. Exploitation requires no credentials or user interaction and is low-complexity once the attacker has L2 adjacency to a system running the vulnerable framework, though it is not reachable from the internet and CISA SSVC rates it non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis and EPSS is low (0.30%, 22nd percentile); Dell has released a fixed version.
Local privilege escalation in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows an attacker who already holds a low-privileged local account to escalate to higher privileges on the host. The flaw is an unchecked return value (CWE-252) in the framework, and successful exploitation yields total technical impact - high confidentiality, integrity, and availability loss - although it requires local access and an existing foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit has been identified at time of analysis, EPSS is a low 0.13% (3rd percentile), and CISA SSVC records Exploitation: none and Automatable: no; a vendor patch is available from Dell.
Local privilege escalation in the Dell Update Package (DUP) Framework, versions prior to 26.07.03, allows a low-privileged user who already holds a foothold on the host to inject OS commands and gain elevated privileges (CVSS 3.1 base 7.8; vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a CWE-78 command-injection issue that needs local access and no user interaction, and a vendor fix is available in version 26.07.03 per Dell advisory DSA-2026-417. No public exploit code has been identified at time of analysis, EPSS estimates exploitation likelihood at roughly 0.5% (42nd percentile), and CISA SSVC records no evidence of exploitation. This is a local-only elevation-of-privilege primitive, not a remotely reachable flaw, so exposure is limited to hosts where the DUP Framework is installed and invoked.
Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), and a vendor patch is available in ObjectScale 4.4.0.0.
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) versions prior to 2605.0.3.683 lets a remote attacker reach protected functionality without supplying any credentials, resulting in unauthorized access with high confidentiality and integrity impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1). Affected deployments are WMS consoles (CPE cpe:2.3:a:dell:wyse_management_suite) that sit on management networks and expose the unauthenticated endpoint; because exploitation requires no authentication or user interaction, the practical barrier is network reachability rather than attacker capability. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.25% (17th percentile) indicates low predicted exploitation activity over the next 30 days, so operational urgency is driven primarily by how exposed a given console is.
Unrestricted file upload in Dell Wyse Management Suite prior to 2605.0.3.683 lets a remote attacker upload files of a dangerous type to the WMS server, which Dell states can lead to remote code execution; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required under the described conditions. Real-world risk is tempered by exposure: WMS is an internal enterprise endpoint-management platform normally hosted on administrative network segments rather than the public internet, so a successful attack generally presupposes the adversary already has network reachability to the WMS instance, and Dell's advisory does not disclose the vulnerable upload endpoint or any non-default configuration dependency. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.36% (30th percentile), which is consistent with a recent, narrowly deployed enterprise product rather than evidence that exploitation is unattractive.
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, where an unrestricted file-upload weakness (CWE-434) lets a remote attacker submit a file of a dangerous type that the server then processes. Per the Dell-published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8), no credentials, user interaction, or special preconditions are required, and successful exploitation yields full confidentiality, integrity, and availability impact. At time of analysis there is no public exploit identified and no CISA KEV listing; EPSS is only 0.36% (30th percentile), so while the theoretical severity is maximal, real-world pressure is currently low and practical risk is dominated by whether the WMS server is reachable from untrusted networks.
Unauthenticated remote code execution affects Dell Wyse Management Suite versions prior to 2605.0.3.683 through an unrestricted upload of a dangerous file type that the server can subsequently execute. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical), but exploitation requires network reachability to the WMS server and the presence of the vulnerable upload endpoint; Dell has not disclosed the exact endpoint or any required non-default configuration. No public exploit identified at time of analysis and no CISA KEV entry is present, while EPSS is low at 0.36% (30th percentile), so practical risk is highest for WMS instances that are internet-facing or broadly reachable from untrusted networks.
Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. Dell has released a fixed build, OS10 10.6.1.3, under advisory DSA-2026-343.
Session fixation in Dell SmartFabric OS10 Software versions prior to 10.6.1.3 allows remote, unauthenticated attackers to plant or predict a management session identifier and subsequently hijack that session once a legitimate administrator logs in, resulting in session theft with the full privileges of the compromised account. Dell's published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that score overstates the issue on two counts: successful exploitation hinges on a victim authenticating into the attacker-controlled session (effectively a user-interaction requirement, UI:R), and the real-world impact is bounded by the privileges of the hijacked account, making confidentiality and integrity exposure meaningful but not unconditional. There is no public exploit identified at time of analysis - CISA SSVC records no observed exploitation and no proof-of-concept code is referenced - and the attacker can only realize impact through a victim-logon step, so the practical risk is lower than the raw 9.8 suggests while still warranting prompt patching of internet- or management-plane-reachable deployments.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker to run code within the application context of the affected thin client, per Dell advisory DSA-2026-389. The root cause is a protection mechanism failure (CWE-284) that bypasses an intended security control rather than exploiting a memory-corruption bug directly. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the network-reachable, no-authentication attack profile makes it high priority.
Authenticated remote command execution in Dell ThinOS 10 (builds prior to 2605_10.2616) allows an attacker who already holds high administrative privileges on the device to inject OS commands into a privileged management function, achieving command execution with high confidentiality, integrity, and availability impact. The assessed vector (CVSS 7.2, AV:N/AC:L/PR:H/UI:N) means the flaw is not reachable by an anonymous remote attacker and is not automatable per CISA SSVC, which records no exploitation activity; no public exploit code was identified at time of analysis. EPSS sits at a moderate 2.28% (82nd percentile), consistent with a privilege-gated issue rather than a mass-exploitation emergency.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to inject and execute arbitrary OS commands via improper neutralization of special elements in a command context (CWE-78). Dell released the vulnerability itself (DSA-2026-389) and a fixed build is available; there is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who already sits on the same logical or physical network segment as the thin client to run arbitrary commands on the device. No credentials and no user interaction are required, and the vendor CVSS 3.1 vector scores it 8.8 (High) with full confidentiality, integrity and availability impact, but the adjacent (AV:A) attack vector means it is not reachable from the general internet or across routed boundaries by default. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 1.29% (69th percentile), CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Dell has published a fix via advisory DSA-2026-389.
OS command injection in Dell iDRAC9 and iDRAC10 baseboard management controllers permits a high-privileged remote attacker to execute arbitrary operating system commands on the BMC firmware layer. Affected generations span iDRAC9 14G (pre-7.00.00.184), iDRAC9 15G/16G (pre-7.30.10.50), and iDRAC10 17G (pre-1.30.30.50). Dell has released patched firmware across all affected generations; no public exploit or active exploitation is identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to execute arbitrary operating system commands, resulting in full confidentiality, integrity, and availability compromise of the affected system. Both the Appliance deployment form (virtual/hardware) and the Application package are affected, with fix versions 5.36.00.16 and 5.36.00.00 respectively confirmed by Dell advisory DSA-2026-382. No public exploit code and no CISA KEV active-exploitation listing are identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) variants - enables a locally authenticated low-privileged attacker to execute arbitrary operating system commands, yielding full compromise of confidentiality, integrity, and availability of the affected host. Dell confirmed the issue in advisory DSA-2026-382 and released patches for both deployment forms. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and the attack as non-automatable.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 Virtual Edition allows an unauthenticated network attacker to inject arbitrary operating-system commands via improperly neutralized special elements (CWE-78). Affected are the SCG 5.0 Appliance component before 5.36.00.16 and the SCG 5.0 Application component before 5.36.00.00; a vendor patch is available via Dell advisory DSA-2026-382. No public exploit identified at time of analysis, but the network-reachable, no-authentication attack path and 9.8 CVSS make this a high-priority remote-takeover risk.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance (before 5.36.00.16) and Application (before 5.36.00.00) variants - allows an unauthenticated remote attacker to inject and execute commands, described by Dell as script injection. The CVSS 9.8 vector rates all three impacts as high (C:H/I:H/A:H), though CISA SSVC scores the technical impact as only partial. No public exploit identified at time of analysis and SSVC exploitation status is 'none', but the flaw is marked automatable, raising the risk of scanning-driven mass exploitation once a technique surfaces.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application deployment forms - enables a locally authenticated low-privileged user to inject and execute arbitrary operating system commands. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with full confidentiality, integrity, and availability impact on the underlying host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as currently none with non-automatable attack delivery.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote high-privileged attacker to execute arbitrary SQL commands against the backend database, resulting in unauthorized access to sensitive data and potential data manipulation. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and the mandatory high-privilege requirement substantially limits the realistic attack surface.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
External control of file name or path (CWE-73) in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to influence filesystem path resolution, resulting in unauthorized filesystem access. Both the Appliance form factor (versions before 5.36.00.16) and the Application form factor (versions before 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit code or active exploitation has been identified at this time.
Local privilege escalation in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows a low-privileged local user to gain elevated privileges and, in some exploitation paths, to disrupt the service and cause denial of service. The victim must already have an authenticated local session on the affected machine (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.0); attack complexity is high, indicating a non-deterministic race or specific runtime state is required rather than a reliable one-shot trigger, and no user interaction is needed. No public exploit code has been identified at time of analysis, no CISA KEV listing is present, and no EPSS score was provided, so this should be treated as a moderate-priority local hardening issue rather than an urgent remote-exploitation emergency.
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Dell Terraform Provider for Redfish versions before 1.6.2 exposes Redfish BMC traffic, including credentials, to man-in-the-middle interception because TLS certificate verification is unconditionally disabled in its base HTTP transport. This critical-severity flaw (CVSS 9.0) allows an unauthenticated remote attacker who occupies a MITM position to capture or alter sensitive Redfish API communications, though exploitation is condition-gated to active provider-to-BMC traffic windows and is materially lower risk on trusted, isolated management segments. No public exploit identified at time of analysis; Dell recommends upgrading to 1.6.2.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager (versions prior to the fixed build, reported as 5.34.00.16 in the CVE description and as 5.36.00.16 in ENISA EUVD data) lets an attacker who already holds high-privilege authenticated access to the appliance reach functionality that should be restricted, breaking authorization boundaries rather than authentication itself (CWE-863). The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High), so the network path is remote and low-complexity with no user interaction, but the PR:H prerequisite means the attacker must be a malicious or compromised admin/operator account - anonymous or low-privileged users cannot trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.27% (18th percentile) and the CISA SSVC decision is Exploitation: none, Automatable: no, Technical Impact: total, which makes this a moderate, patch-on-normal-cycle item rather than an emergency. A vendor patch is available per Dell's advisory (DSA-2026-385), though the exact minimum fixed version should be verified with Dell given the discrepancy between 5.34.00.16 and 5.36.00.16 across sources.
Incorrect permission assignment on critical resources in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged local user on the SCG host read and modify files or objects that should have been restricted, producing high confidentiality and high integrity impact together with a bypass of the product's own protection mechanisms (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The practical prerequisite is a pre-existing foothold on the appliance - a local shell or a service account - so the realistic threat actor is an insider or someone who has already compromised the host; there is no remote or unauthenticated path to trigger the flaw and no user interaction is required. No public exploit code identified at time of analysis, EPSS is 0.09% (0th percentile) and CISA's SSVC assessment records exploitation as 'none' with automatable 'no', making this a moderate, non-urgent priority for organizations running the affected versions.
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-privileged user to bypass authorization by manipulating a user-controlled key (object/resource identifier) that the application trusts, escalating to a higher-privileged role with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only installations running versions below the patched build are affected; the vulnerability is not remotely exploitable without credentials, requires no victim interaction, and per available intelligence there is no public exploit code and no confirmed active exploitation (CISA KEV not listed, SSVC exploitation: none, EPSS 0.18% / 6th percentile). The independence assessment rates this a credible but not emergency-level priority: the attacker must first hold valid low-privilege credentials, but once inside can turn a benign identifier into an elevation-of-privilege primitive.
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager without any authentication check, bypassing protection mechanisms to read sensitive information and gain unauthorized access; instances running versions prior to 5.34.00.16 are affected. The vulnerability carries a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality and access bypass - no integrity or availability impact is indicated. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) or EPSS signal in the supplied data, so real-world risk is primarily gated by whether the management service is reachable from an untrusted network.
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already holds high-privilege (administrative) credentials to coerce the appliance into issuing requests to attacker-chosen destinations, causing information disclosure, unauthorized access, and bypass of protection mechanisms (CWE-918; CVE-2026-78024). The scope-change metric (S:C) indicates forged requests can affect systems beyond the vulnerable component, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N confirms the exploitation prerequisite is authenticated administrator access - this is the primary limiting factor and means unauthenticated or low-privileged remote users cannot trigger it. At time of analysis there is no public exploit identified and no confirmed active exploitation (CISA KEV: no; SSVC exploitation: none), EPSS is only 0.20% (9th percentile), and a vendor patch is available, so this ranks as a moderate, non-urgent priority despite its 8.7 'High' base score.
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamper with a user-controlled key to reach resources and actions reserved for higher-privileged accounts, resulting in elevation of privileges with high impact to confidentiality, integrity, and availability. Only SCG Policy Manager builds below the vendor-fixed release are affected; exploitation requires an existing valid low-privileged account plus network reachability to the product interface, so fully unauthenticated outsiders cannot trigger it. Risk is real but not emergency-grade: EPSS is low at 0.18 percent (7th percentile), CISA SSVC rates exploitation as none and automatable as no, and no public exploit has been identified at time of analysis. Vendor-released patches are available through Dell advisory DSA-2026-385.
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release) lets a remote, low-privileged attacker who already holds valid credentials on the appliance defeat intended authorization controls via a 'failing open' error-handling flaw (CWE-636). Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no availability impact. EPSS is low at 0.20% (9th percentile), CISA SSVC records no observed exploitation, and no public exploit identified at time of analysis, so priority is elevated-but-not-emergency, driven mainly by exposure of the management interface and the presence of low-privileged accounts.
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allow a low-privileged, authenticated remote attacker to move from limited access to full control of the affected host. Exploitation requires an existing low-privileged foothold on a network-reachable Policy Manager instance running a version prior to the fixed release; no victim interaction is needed and attack complexity is low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.33% (24th percentile), so signals are mostly consistent and indicate a serious but not emergency-grade issue, with realistic risk concentrated where Policy Manager is exposed to untrusted networks or low-privilege credentials are easy to obtain.
Information disclosure in Dell Secure Connect Gateway (SCG) Policy Manager (CPE cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager) arises from an insecure default initialization of a resource (CWE-1188), meaning affected builds ship or configure a resource in a state that exposes sensitive data out of the box. Exploitation is not remote or anonymous: it requires an attacker who already has local access to the host and a low-privileged authenticated account (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no user interaction needed. Risk is moderate and urgency low despite the 7.1 base score: EPSS is only 0.09% (0th percentile), CISA SSVC rates Exploitation 'none' and Automatable 'no', and no public exploit code or confirmed active exploitation was identified at time of analysis.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid low-privileged account and network reachability to the appliance invoke privileged functionality that lacks a proper authorization check, producing high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is not remote-unauthenticated - a pre-existing low-privileged credential is a hard prerequisite. No public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.16% (5th percentile), CISA SSVC rates exploitation as none and automatable as no, and a vendor patch is available.
Privilege elevation on Dell client endpoints that have Dell Command | Configure (DCC) installed at a version below 5.2.3.35, driven by improper handling of mixed encoding (CWE-175) that allows crafted, ambiguously encoded input to be processed in a way that yields elevated rights. Dell labels the flaw 9.8 with an AV:N/AC:L/PR:N/UI:N vector, but our independent assessment treats it as a local, low-privilege-triggered defect (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because DCC is an optional local client-configuration utility rather than a network service and the advisory never identifies a remotely reachable interface - the input signals are sharply conflicting and must not be reconciled uncritically. There is no public exploit identified at time of analysis, EPSS is low at 0.27% (18th percentile), CISA SSVC records exploitation as none, and a vendor patch is available.
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. CVSS 3.1 scores it 8.2 with a changed scope and high confidentiality, integrity and availability impact, but no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incorrectly secured critical resource to gain higher privileges (CVSS 8.2, CWE-732). Exploitation requires local access, a valid low-privileged account, and user interaction-most plausibly an administrator running the updater after malicious content has been staged in a writable location-so remote or unauthenticated attack is not possible. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
OS command injection in Dell OpenManage Integration for Microsoft Windows Admin Center (versions prior to 3.7.0) allows an authenticated low-privileged remote attacker to execute arbitrary commands on the management host, compromising confidentiality, integrity, and availability. The vulnerability requires network access (AV:N) and low privileges (PR:L) but no user interaction (UI:N), and it is only reachable where the Dell OpenManage Integration extension is installed. No public exploit code or active exploitation is currently identified; the vendor has released a security advisory (DSA-2026-442) with a fix in version 3.7.0.
Missing authentication in the csm-authorization-tenant gRPC service (TenantService) shipped with Dell Container Storage Modules (CSM) allows an unauthenticated attacker on the adjacent network to create tenant entities, inject roles across tenant boundaries, and modify storage access-control flags on any deployment running CSM authorization prior to 1.18.0. The flaw is rated CVSS 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflecting high integrity impact with no authentication and no user interaction required, though it is only reachable from an adjacent network segment rather than the public internet. There is no public exploit identified at time of analysis and no CISA KEV listing; multiple signals point to a moderate, not top-tier, priority, with exposure concentrated in clusters that actually deploy the CSM authorization module and do not segment its gRPC control plane from untrusted pods or hosts.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Predictable, insufficiently random values in Dell Container Storage Modules (CSM) before 1.18.0 allow an unauthenticated attacker with local access to a host or Kubernetes node to tamper with information and degrade availability (CVSS 7.7, C:N/I:H/A:H). The flaw cannot be triggered over the network - it requires local presence on a CSM-managed node - and needs no user interaction, while confidentiality is unaffected. No public exploit code has been identified at time of analysis, and the local-access prerequisite keeps this a moderate-priority issue rather than a high-urgency one despite its High base score.
Improper TLS certificate validation in the Dell Container Storage Modules (CSM) proxy-server component - all versions prior to 1.18.0 - allows an attacker holding an adjacent network position and performing a man-in-the-middle interception of the proxy-server's TLS traffic to impersonate the storage backend and capture storage backend administrator credentials. No authentication or user interaction is required, and the CVSS 3.1 score of 8.2 reflects high confidentiality and integrity impact with scope change, since compromise of the proxy-server crosses into the storage array's administrative domain. Exploitation is constrained by high attack complexity (AC:H) and the adjacency requirement, which keep the flaw off the routable internet; no public exploit code exists and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, making this a credible but conditional priority for environments where CSM proxy-server traffic is not isolated to a trusted segment.
Server-side template injection in Dell Container Storage Modules (CSM) releases prior to 1.18.0 allows a low-privileged authenticated remote user to escalate privileges within and beyond the affected component, with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The flaw is rated Scope:Changed with high confidentiality and integrity impact and no availability impact, meaning a compromise of the template-evaluating component can cross a security boundary and affect resources the attacker would not normally control. At time of analysis there is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit identified; the practical barrier is that a valid low-privilege account with network access to CSM is required before the injection can be delivered.
Unauthenticated remote attackers can gain elevated privileges against Dell Container Storage Modules deployments because the CSM Authorization component ships with hard-coded credentials, as described in CWE-798 and scored CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every CSM release prior to 1.18.0 is affected per the vendor advisory DSA-2026-448, and exploitation requires only that the CSM Authorization service be deployed and reachable over the network - no account, token, or user interaction is needed. Exposure is bounded by deployment footprint: only Kubernetes clusters using CSM Authorization to front Dell storage arrays are at risk, and network segmentation that keeps the authorization service off untrusted networks materially reduces reachability. No public exploit code and no confirmed active exploitation were identified at the time of analysis, but the unauthenticated, no-interaction exploit profile makes this a high-priority patch candidate.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Privilege escalation in Dell Container Storage Modules (CSM) Operator versions prior to 1.18.0 allows an authenticated, low-privileged attacker who can create or modify the ContainerStorageModule Custom Resource to obtain root-level access on Kubernetes cluster nodes. The flaw is an improper privilege management weakness (CWE-269) in the ContainerStorageModule Custom Resource reconciler, rated CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) because the impact crosses a security scope boundary and delivers total confidentiality, integrity, and availability impact against the underlying nodes. Exploitation is not unrestricted: it requires a low-privileged cluster credential with rights to submit or alter the CSM Custom Resource (PR:L, no user interaction), so multi-tenant clusters that grant this permission broadly are the highest-risk deployments. No public exploit code has been identified at time of analysis and no CISA KEV entry exists; EPSS data was not provided.
Unauthenticated remote attackers can exploit Dell Container Storage Modules (CSM) deployments running versions prior to 1.18.0 to elevate privileges, because a critical function is reachable without any authentication check (CWE-306); the vendor scores this CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment concurs that this is a genuine top-priority issue rather than a high-score/low-risk artifact. Per the provided CVSS vector the attack is unauthenticated, requires no user interaction, and involves no special difficulty (AC:L), so any party who can route traffic to the vulnerable CSM endpoint can trigger it. The decisive limiting factor is network exposure of that endpoint - CSM components frequently run inside a Kubernetes cluster, so realistic blast radius depends on whether the deployed service is reachable from an attacker-controlled network segment. No publicly available exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote credential theft in the Dell Container Storage Modules (CSM) Authorization component before v1.18.0 allows any attacker who can reach the csm-authorization-storage gRPC service to retrieve the storage-backend administrator credentials for every registered storage array, turning a single unauthenticated request path into full administrative control of the underlying storage infrastructure. The defect is a missing-authentication error (CWE-306) in a critical function and carries a CVSS 3.1 score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), with the scope change reflecting the pivot from the CSM authorization service into the storage arrays themselves. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the principal gating factors are environmental - the optional Authorization module must be deployed, its gRPC endpoint must be reachable from the attacker's network position, and at least one array must already be onboarded so that credentials exist to steal - which is why Dell's DSA-2026-448 advisory and the availability of a fixed release make this a genuine top-priority item rather than a theoretical high-CVSS score.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-privileged local user raise their privileges by abusing incorrectly assigned permissions on a critical resource. The flaw is not remotely or unauthenticated-exploitable: an attacker must already hold local, low-privileged access to the host (PR:L, AV:L), and exploitation additionally depends on a high-complexity precondition such as a race condition or a specific system state (AC:H) plus the mis-permissioned resource being present in the deployed configuration. No user interaction is required, and no public exploit identified at time of analysis; Dell has released a fix in 5.34.00.16 via advisory DSA-2026-385.
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.
Remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager allows an unauthenticated, remote attacker to execute code or tamper with/disclose information on affected appliances by exploiting a missing integrity check on code the product downloads, affecting versions prior to 5.34.00.16 and prior to 5.36. Realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position or a spoofed/compromised download source - which is why our assessment adjusts the vendor's 9.8 score to AC:H while retaining PR:N and UI:N. A vendor patch is available (5.36.00.16; 5.34.00.16 for the 5.34 branch), and there is no evidence of active exploitation or public exploit code; EPSS is 0.11% (1st percentile) and CISA SSVC rates exploitation as 'none' and automatable as 'no'.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who already occupies an adjacent-network position intercept, forge or tamper with protected connections, exposing sensitive information and defeating protection mechanisms. Affected builds are all versions prior to 5.34.00.16 and prior to 5.36; the CVSS vector (AV:A/AC:L/PR:N/UI:N) indicates exploitation needs no credentials and no user interaction, but does require the attacker to be on the same or an adjacent network segment as the SCG Policy Manager rather than reaching it across the internet. No public exploit code and no active exploitation have been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and EPSS is negligible at 0.08% (0th percentile), so risk is driven by network positioning and management-plane exposure rather than mass exploitation.
An unauthenticated attacker (CVSS PR:N) who obtains physical access to the on-chip debug and test interface of the SMCU on Dell 17G BOSS-N1 controllers can bypass the intended access controls and gain unauthorized access to the controller before firmware version 2.2.13.2038 is applied. Exploitation is constrained by the need for direct hardware contact - typically an opened chassis and a debug connection - plus high attack complexity and a required interaction step (AV:P/AC:H/UI:R), so the practical risk is LOW despite the HIGH 7.0 base score with scope change and full confidentiality, integrity, and availability impact on the component. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); realistic exposure is limited to insider, supply-chain, in-transit, decommissioned/RMA, or unattended data-center scenarios.
Incorrectly assigned permissions on critical resources shipped with Dell Trusted Device Client (all versions prior to 8.1.359.0) let a low-privileged local user write to or modify files, directories, registry keys, or service configuration belonging to the agent, enabling tampering with trusted-device state and, per the vendor vector, disclosure of sensitive data (CVSS 3.1 base 7.1, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Exploitation is strictly local: it requires an existing interactive or session-level account on the Windows endpoint and the underlying CWE-732 misconfiguration; there is no remote or unauthenticated vector, and no code execution or availability impact is claimed. Our independent assessment narrows the confidentiality component to Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) and stresses that the realistic outcome is tampering with client data and configuration rather than host compromise. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor advisory is the only reference.
Improper authorization in Dell Rugged Control Center (RCC) builds prior to 5.2.206 allows a low-privileged local user to escalate privileges on an affected rugged Dell endpoint. The vendor rates this CVSS 8.1 with a local attack vector, low privileges required, scope change, and high integrity and availability impact (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H), meaning an attacker or malware must already hold a foothold on the specific rugged device - it is not remotely or unauthenticated exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Dell has released a fixed build (5.2.206) via advisory DSA-2026-410.
Missing authentication for a critical device function in Dell ThinOS 10 (all versions prior to SecurityAddon_2605.10.2766_T10) allows an unauthenticated remote attacker who can reach the exposed function to gain unauthorized access to it, reflected in a CVSS:3.1 base score of 8.6 under the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, where the high integrity impact dominates and confidentiality and availability effects are limited. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine priority signal rather than a confirmed-exploited emergency. The main practical constraint on exploitation is network reachability: ThinOS endpoints are typically deployed inside enterprise/VDI network segments rather than exposed to the public internet, so meaningful risk arises when an attacker already has a foothold on a segment from which the affected service can be reached.
Improper TLS certificate validation in Dell ThinOS 10 endpoints running SecurityAddon builds prior to 2605.10.2766_T10 lets an adjacent-network attacker bypass a protection mechanism and gain unauthorized access to client communications and credentials. The flaw is rated CVSS 8.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), meaning no authentication or user interaction is required, but the attacker must already sit on the same Layer-2 segment, VLAN, or Wi-Fi network as the thin client to position themselves for a machine-in-the-middle interception. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine elevated-priority issue rather than an emergency - the practical risk is driven by how flat and trusted the thin-client network segment is.
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
Missing authentication for a critical function in Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 allows remote attackers to reach functionality that should require a credential check, resulting in unauthorized access with high confidentiality and integrity impact. The assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N (7.4) confirms no privileges and no user interaction are required, while the high attack-complexity rating indicates a non-trivial precondition must be satisfied rather than a guaranteed single-request compromise. Real-world risk is bounded by exposure: the Policy Manager interface must be network-reachable, and SCG is a specialized enterprise gateway typically deployed in restricted management networks; no public exploit was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Local privilege escalation in Dell Command | Monitor (DCM) versions prior to 10.13.2 allows an authenticated low-privileged Windows user to gain elevated privileges by abusing an incorrectly secured resource that the DCM agent accesses at higher integrity. Successful exploitation requires an existing local foothold on the endpoint, but needs no user interaction and changes scope (S:C) because the attacker leverages DCM's elevated context to impact the wider host - confidentiality and integrity are both rated High, availability is not. There is no remote or unauthenticated attack path, and no public exploit identified at time of analysis; Dell has published a fix in the DSA-2026-380 advisory, making this a credible but not urgent patching priority for fleets running older DCM agents.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 write sensitive information - specifically credentials passed to its cmdlets - into the Windows PowerShell event log, where they can be harvested by a low-privileged local user who can read that log. Exploitation requires an authenticated local presence on the Windows host (CVSS vector AV:L/PR:L) and depends on privileged automation having actually run through DCPP so that secrets were logged first; no user interaction is required. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV, but the vendor assigns it a 7.8 severity while our independent assessment treats the impact as confidentiality-only (C:H/I:N/A:N), materially lowering real-world risk given the local-only vector, the dependency on prior DCPP use, and the niche deployment footprint.
Code execution can be achieved through an uncontrolled search path in Dell Server Update Utility (SUU) and its bundled Driver Packs for Windows and Linux at all versions prior to 26.07.01, which load libraries from locations an attacker may be able to control (CWE-427). Exploitation is local and not remotely reachable: per the CVSS vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) an attacker must already hold low-privileged local access, must be able to plant a malicious library in a directory the utility searches, and must wait for a higher-privileged user or administrator to subsequently run SUU so the planted code loads with that user's privileges. No public exploit code was identified and the flaw is not confirmed as actively exploited (not in CISA KEV); Dell has released a fixed version, 26.07.01, via advisory DSA-2026-422.
Elevation of privilege in Dell SmartFabric Manager versions prior to 2.2.1 allows a low-privileged, authenticated remote attacker to bypass data authenticity verification and gain full control of the affected host, with the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicating total loss of confidentiality, integrity, and availability. Exploitation requires an existing low-privilege session plus network reachability to the SmartFabric Manager management interface and the ability to inject data the product fails to authenticate (CWE-345); it is not automatable per the SSVC assessment, and no public exploit code has been identified at time of analysis. EPSS is low at 0.20% (10th percentile), and CISA KEV does not list this CVE, so mass opportunistic exploitation is not currently indicated, though a vendor patch is available in 2.2.1.
Information disclosure in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allows a locally authenticated low-privileged attacker to read sensitive data, potentially including credentials or configuration details, with high confidentiality impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 7.3) requires local access and an existing low-privileged account, but no user interaction and low complexity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Dell OpenManage Server Administrator versions prior to 11.1.0.3 lets remote, unauthenticated attackers who can induce a user interaction coerce the management agent into issuing requests to attacker-chosen internal or external targets, exposing sensitive internal services such as management APIs and cloud metadata endpoints. The flaw (CWE-918) is rated CVSS 3.1 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N), with the scope-change and confidentiality-high components reflecting that forged traffic escapes the OMSA trust boundary while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at the time of analysis, and real-world impact depends on the OMSA web interface being network-reachable and the managed host having line-of-sight to valuable internal targets.
Elevation of privilege in Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3 lets a network-positioned attacker who already holds high privileges escalate to full control of the managed node, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.2). The underlying weakness is improper privilege management (CWE-269) reachable over the OMSA network management interface with low complexity and no user interaction, affecting Windows managed-node patch installations as well as managed nodes on RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04. No public exploit has been identified at time of analysis; the dominant limiting factor is the PR:H precondition, meaning anonymous or low-privileged remote attackers cannot trigger this issue.
Privilege escalation and information tampering in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allow a low-privileged authenticated remote attacker to modify data and gain unauthorized access through improper privilege management. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) indicates network reachability with low attack complexity, requiring only low privileges and no user interaction, and resulting in high integrity and availability impact with no confidentiality loss. No public exploit identified at time of analysis.
Stack-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an attacker who already holds high privileges on the OMSA service to achieve remote code execution over the network. Exploitation is constrained by the CVSS PR:H prerequisite-only compromised administrative accounts, malicious insiders, or chaining from another privilege-granting flaw can trigger it-but no user interaction is required and attack complexity is low. No public exploit code or CISA KEV active exploitation is identified in the available intelligence.
Unauthenticated path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 lets a remote attacker read arbitrary files from the managed node's filesystem. The flaw is reachable over the network with no credentials, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), but impact is confidentiality-only: an attacker can exfiltrate files, not modify them or disrupt the service. All shipped managed-node platforms are affected (Windows patch bundle, RHEL 8.10, RHEL 9.4, SLES 15, Ubuntu 22.04); no public exploit identified at time of analysis and the vulnerability has not been confirmed actively exploited (CISA KEV), so practical risk tracks directly with how broadly the OMSA management interface is reachable.
Hard-coded credentials in Dell OpenManage Server Administrator (OMSA) managed-node builds before 11.1.0.3 let an unauthenticated remote attacker reach the management service and log in with credentials baked into the product, bypassing authentication entirely (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Affected builds are the Windows managed-node patch package and the RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed-node packages; exploitation needs only network reachability to the OMSA service, but in practice those interfaces are usually confined to internal management networks, so internal and lateral exposure is the more realistic path. Exploitation status: no public exploit identified at time of analysis (CISA SSVC records Exploitation: none), and EPSS is low at 0.31% (24th percentile); a vendor patch exists in version 11.1.0.3, which removes the condition outright, so the residual risk is driven by unpatched, network-exposed OMSA instances rather than by observed attack activity.
Use of a hard-coded cryptographic key in Dell OpenManage Server Administrator (OMSA) Managed Node builds prior to 11.1.0.3 means an unauthenticated remote attacker who can reach the OMSA management service may recover the statically embedded key shared by every installation and leverage it to bypass authentication for unauthorized access to managed nodes. Affected builds are the Windows managed-node patch and the RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04 packages, all of which are fixed in vendor version 11.1.0.3. Exploitation has not been confirmed in the wild (no CISA KEV listing), CISA's SSVC decision framework rates the issue as not automatable with no observed exploitation, and EPSS is low at 0.38% (32nd percentile), while the assessed CVSS of 9.8 reflects full confidentiality, integrity and availability impact if the flaw is successfully abused.
Remote code execution in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3: a heap-based buffer overflow (CWE-122) that an attacker holding administrator-level privileges on the OMSA service can trigger over the network without user interaction, gaining code execution on the managed host with full confidentiality, integrity, and availability impact. The flaw scores 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and affects Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed nodes. No public exploit code and no confirmed active exploitation were identified at time of analysis; the high-privilege prerequisite keeps this a privileged-user-to-code-execution escalation rather than a pre-authentication internet-facing exploit, with risk rising where OMSA is exposed to untrusted networks or chained after an authentication bypass such as CVE-2026-81475 in the same DSA-2026-403 bundle.
Unauthenticated remote OS command injection in Dell OpenManage Server Administrator (OMSA) managed-node builds prior to 11.1.0.3 allows a network-reachable attacker to run arbitrary operating-system commands on the host, yielding full confidentiality, integrity, and availability impact (CVSS 8.1, C:H/I:H/A:H, CWE-78). Affected deployments include the Windows managed-node patch build and the managed-node packages for RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04; the vendor rates attack complexity as high (AC:H), so successful exploitation hinges on a specific non-default condition, timing, or crafted-input constraint rather than a single trivial request. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, while hosts already updated to 11.1.0.3 are not affected.
Unauthenticated remote code execution is possible against Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3, where a critical management function can be invoked without any authentication check (CWE-306). Affected deployments include the Windows managed-node patch plus managed-node builds for RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04, and an attacker who can reach the OMSA management interface from the network needs no credentials and no user interaction (CVSS 8.1, PR:N/UI:N), though the AC:H rating indicates the exploit path depends on conditions outside the attacker's control and is not a simple one-shot request. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so real-world risk is currently gated mainly by whether OMSA is exposed beyond a trusted management VLAN rather than by known exploitation.
Information disclosure in Dell OpenManage Server Administrator (OMSA) managed nodes running releases prior to 11.1.0.3, caused by reliance on a broken or risky cryptographic algorithm (CWE-327) that can expose protected data in transit. All managed-node platforms in scope are affected - the Windows managed-node patch build as well as the RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 managed-node packages. The CVSS v3.1 vector carries PR:N (unauthenticated) with network reachability, but our independent assessment raises attack complexity to High because recovering data from a flawed cryptographic algorithm requires the attacker to already observe or intercept the affected traffic (an on-path/man-in-the-middle position) rather than simply sending a request; impact is confidentiality-only. There is no public exploit code and no confirmed active exploitation, and the EPSS score is low at 0.18% (8th percentile), so this is a moderate-priority patching item rather than an emergency. Vendor-released patched builds are available in version 11.1.0.3 per Dell DSA-2026-403.
A heap-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an authenticated local attacker with low privileges to corrupt process memory and escalate to full root/SYSTEM-level control of the managed node. Only hosts with the OMSA managed-node component installed and running are affected, across Windows, RHEL 8.10, RHEL 9.4, SLES 15, and Ubuntu 22.04 packages. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) confirms a local elevation-of-privilege primitive requiring an existing local account but no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory's 'network access' title does not imply an unauthenticated remote path for this CVE.
Unauthenticated remote attackers can bypass security protection mechanisms in Dell OpenManage Server Administrator Managed Node running versions prior to 11.1.0.3 by supplying externally controlled input that dictates which class or code path is instantiated (CWE-470, unsafe reflection). The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N) with integrity-only impact - no confidentiality or availability loss - and remediation is straightforward because Dell has shipped a fixed build, leaving network reachability to the OMSA management service as the practical gating factor. Exploitation status: no public exploit identified at time of analysis; CISA KEV does not list this CVE, EPSS is 0.37% (31st percentile), and CISA SSVC rates exploitation as 'none' with 'partial' technical impact, making this a genuine but not top-tier priority.
Incorrect default permissions in Dell Repository Manager (DRM) versions prior to 3.5.2 let an attacker who already holds a low-privileged account on a Windows host abuse misconfigured files, directories, or service resources to escalate to a higher-privileged context. Dell rates this 8.5 (High) with a remote, scope-changing vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), but our independent assessment scores it 7.8 as a local privilege-escalation issue (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): exploitation requires an existing foothold on a machine where DRM is installed, is not a default unauthenticated remote scenario, and is limited to systems running DRM below 3.5.2. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fixed release (3.5.2) via Dell security advisory DSA-2026-419.
Stack-based buffer overflow in the Dell Update Package (DUP) Framework, affecting versions prior to 26.07.03, allows an unauthenticated attacker on the same local network segment (AV:A) to corrupt stack memory and achieve arbitrary code execution on the affected host with full confidentiality, integrity, and availability impact. Exploitation requires no credentials or user interaction and is low-complexity once the attacker has L2 adjacency to a system running the vulnerable framework, though it is not reachable from the internet and CISA SSVC rates it non-automatable with only partial technical impact. No public exploit code has been identified at time of analysis and EPSS is low (0.30%, 22nd percentile); Dell has released a fixed version.
Local privilege escalation in the Dell Update Package (DUP) Framework, affecting all versions prior to 26.07.03, allows an attacker who already holds a low-privileged local account to escalate to higher privileges on the host. The flaw is an unchecked return value (CWE-252) in the framework, and successful exploitation yields total technical impact - high confidentiality, integrity, and availability loss - although it requires local access and an existing foothold (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8). No public exploit has been identified at time of analysis, EPSS is a low 0.13% (3rd percentile), and CISA SSVC records Exploitation: none and Automatable: no; a vendor patch is available from Dell.
Local privilege escalation in the Dell Update Package (DUP) Framework, versions prior to 26.07.03, allows a low-privileged user who already holds a foothold on the host to inject OS commands and gain elevated privileges (CVSS 3.1 base 7.8; vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw is a CWE-78 command-injection issue that needs local access and no user interaction, and a vendor fix is available in version 26.07.03 per Dell advisory DSA-2026-417. No public exploit code has been identified at time of analysis, EPSS estimates exploitation likelihood at roughly 0.5% (42nd percentile), and CISA SSVC records no evidence of exploitation. This is a local-only elevation-of-privilege primitive, not a remotely reachable flaw, so exposure is limited to hosts where the DUP Framework is installed and invoked.
Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), and a vendor patch is available in ObjectScale 4.4.0.0.
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) versions prior to 2605.0.3.683 lets a remote attacker reach protected functionality without supplying any credentials, resulting in unauthorized access with high confidentiality and integrity impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1). Affected deployments are WMS consoles (CPE cpe:2.3:a:dell:wyse_management_suite) that sit on management networks and expose the unauthenticated endpoint; because exploitation requires no authentication or user interaction, the practical barrier is network reachability rather than attacker capability. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.25% (17th percentile) indicates low predicted exploitation activity over the next 30 days, so operational urgency is driven primarily by how exposed a given console is.
Unrestricted file upload in Dell Wyse Management Suite prior to 2605.0.3.683 lets a remote attacker upload files of a dangerous type to the WMS server, which Dell states can lead to remote code execution; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required under the described conditions. Real-world risk is tempered by exposure: WMS is an internal enterprise endpoint-management platform normally hosted on administrative network segments rather than the public internet, so a successful attack generally presupposes the adversary already has network reachability to the WMS instance, and Dell's advisory does not disclose the vulnerable upload endpoint or any non-default configuration dependency. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.36% (30th percentile), which is consistent with a recent, narrowly deployed enterprise product rather than evidence that exploitation is unattractive.
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, where an unrestricted file-upload weakness (CWE-434) lets a remote attacker submit a file of a dangerous type that the server then processes. Per the Dell-published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8), no credentials, user interaction, or special preconditions are required, and successful exploitation yields full confidentiality, integrity, and availability impact. At time of analysis there is no public exploit identified and no CISA KEV listing; EPSS is only 0.36% (30th percentile), so while the theoretical severity is maximal, real-world pressure is currently low and practical risk is dominated by whether the WMS server is reachable from untrusted networks.
Unauthenticated remote code execution affects Dell Wyse Management Suite versions prior to 2605.0.3.683 through an unrestricted upload of a dangerous file type that the server can subsequently execute. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical), but exploitation requires network reachability to the WMS server and the presence of the vulnerable upload endpoint; Dell has not disclosed the exact endpoint or any required non-default configuration. No public exploit identified at time of analysis and no CISA KEV entry is present, while EPSS is low at 0.36% (30th percentile), so practical risk is highest for WMS instances that are internet-facing or broadly reachable from untrusted networks.
Code execution is possible on Dell SmartFabric OS10 switches running versions prior to 10.6.1.3 because the platform downloads code and software images without validating their integrity (CWE-494), so a high-privileged administrator - or an attacker who has already hijacked such an account - can make the device fetch and execute attacker-supplied code. The vendor rates this 9.1 using CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, but the flaw is explicitly not pre-authentication: remote network reachability to the management plane plus existing administrative credentials are mandatory, which is why CISA's SSVC assessment records Exploitation: none, Automatable: no, and Technical Impact: total, and no public exploit was identified at time of analysis. Dell has released a fixed build, OS10 10.6.1.3, under advisory DSA-2026-343.
Session fixation in Dell SmartFabric OS10 Software versions prior to 10.6.1.3 allows remote, unauthenticated attackers to plant or predict a management session identifier and subsequently hijack that session once a legitimate administrator logs in, resulting in session theft with the full privileges of the compromised account. Dell's published CVSS 3.1 vector scores this 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that score overstates the issue on two counts: successful exploitation hinges on a victim authenticating into the attacker-controlled session (effectively a user-interaction requirement, UI:R), and the real-world impact is bounded by the privileges of the hijacked account, making confidentiality and integrity exposure meaningful but not unconditional. There is no public exploit identified at time of analysis - CISA SSVC records no observed exploitation and no proof-of-concept code is referenced - and the attacker can only realize impact through a victim-logon step, so the practical risk is lower than the raw 9.8 suggests while still warranting prompt patching of internet- or management-plane-reachable deployments.
Arbitrary code execution in Dell ThinOS 10 (all builds prior to 2605_10.2616) allows a remote, unauthenticated attacker to run code within the application context of the affected thin client, per Dell advisory DSA-2026-389. The root cause is a protection mechanism failure (CWE-284) that bypasses an intended security control rather than exploiting a memory-corruption bug directly. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the network-reachable, no-authentication attack profile makes it high priority.
Authenticated remote command execution in Dell ThinOS 10 (builds prior to 2605_10.2616) allows an attacker who already holds high administrative privileges on the device to inject OS commands into a privileged management function, achieving command execution with high confidentiality, integrity, and availability impact. The assessed vector (CVSS 7.2, AV:N/AC:L/PR:H/UI:N) means the flaw is not reachable by an anonymous remote attacker and is not automatable per CISA SSVC, which records no exploitation activity; no public exploit code was identified at time of analysis. EPSS sits at a moderate 2.28% (82nd percentile), consistent with a privilege-gated issue rather than a mass-exploitation emergency.
Remote code execution in Dell ThinOS 10 (versions prior to 2605_10.2616) allows an unauthenticated remote attacker to inject and execute arbitrary OS commands via improper neutralization of special elements in a command context (CWE-78). Dell released the vulnerability itself (DSA-2026-389) and a fixed build is available; there is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Remote code execution in Dell ThinOS 10 (all versions prior to 2605_10.2616) allows an unauthenticated attacker who already sits on the same logical or physical network segment as the thin client to run arbitrary commands on the device. No credentials and no user interaction are required, and the vendor CVSS 3.1 vector scores it 8.8 (High) with full confidentiality, integrity and availability impact, but the adjacent (AV:A) attack vector means it is not reachable from the general internet or across routed boundaries by default. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 1.29% (69th percentile), CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and Dell has published a fix via advisory DSA-2026-389.
OS command injection in Dell iDRAC9 and iDRAC10 baseboard management controllers permits a high-privileged remote attacker to execute arbitrary operating system commands on the BMC firmware layer. Affected generations span iDRAC9 14G (pre-7.00.00.184), iDRAC9 15G/16G (pre-7.30.10.50), and iDRAC10 17G (pre-1.30.30.50). Dell has released patched firmware across all affected generations; no public exploit or active exploitation is identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to execute arbitrary operating system commands, resulting in full confidentiality, integrity, and availability compromise of the affected system. Both the Appliance deployment form (virtual/hardware) and the Application package are affected, with fix versions 5.36.00.16 and 5.36.00.00 respectively confirmed by Dell advisory DSA-2026-382. No public exploit code and no CISA KEV active-exploitation listing are identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) variants - enables a locally authenticated low-privileged attacker to execute arbitrary operating system commands, yielding full compromise of confidentiality, integrity, and availability of the affected host. Dell confirmed the issue in advisory DSA-2026-382 and released patches for both deployment forms. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and the attack as non-automatable.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 Virtual Edition allows an unauthenticated network attacker to inject arbitrary operating-system commands via improperly neutralized special elements (CWE-78). Affected are the SCG 5.0 Appliance component before 5.36.00.16 and the SCG 5.0 Application component before 5.36.00.00; a vendor patch is available via Dell advisory DSA-2026-382. No public exploit identified at time of analysis, but the network-reachable, no-authentication attack path and 9.8 CVSS make this a high-priority remote-takeover risk.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance (before 5.36.00.16) and Application (before 5.36.00.00) variants - allows an unauthenticated remote attacker to inject and execute commands, described by Dell as script injection. The CVSS 9.8 vector rates all three impacts as high (C:H/I:H/A:H), though CISA SSVC scores the technical impact as only partial. No public exploit identified at time of analysis and SSVC exploitation status is 'none', but the flaw is marked automatable, raising the risk of scanning-driven mass exploitation once a technique surfaces.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application deployment forms - enables a locally authenticated low-privileged user to inject and execute arbitrary operating system commands. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with full confidentiality, integrity, and availability impact on the underlying host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as currently none with non-automatable attack delivery.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose both the Appliance and Application deployments to unauthenticated remote information disclosure. Any attacker who discovers or reverse-engineers the embedded static credentials - which cannot be changed by administrators - can authenticate to the gateway without valid user accounts and access sensitive information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no privileges or user interaction; no public exploit or CISA KEV listing is recorded at time of analysis.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 allow a remote, unauthenticated attacker to authenticate to the service using the static credentials and access sensitive information. Both the Appliance variant (all versions prior to 5.36.00.16) and the Application variant (all versions prior to 5.36.00.00) are affected, as confirmed by Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified, but CWE-798 credentials are static across all unpatched installations worldwide, meaning any party with knowledge of them can exploit any exposed instance without further effort.
Hard-coded credentials in Dell Secure Connect Gateway (SCG) 5.0 expose sensitive information to unauthenticated remote attackers across both the Appliance and Application deployment variants. The vulnerability (CWE-798) allows an attacker who discovers or possesses the embedded credentials to authenticate without authorization and access confidential data. Dell has released patched versions under advisory DSA-2026-382, and no public exploits or CISA KEV listing have been identified at time of analysis.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote high-privileged attacker to execute arbitrary SQL commands against the backend database, resulting in unauthorized access to sensitive data and potential data manipulation. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and the mandatory high-privilege requirement substantially limits the realistic attack surface.
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a previously captured request indefinitely, forging ADMIN-level access and refresh tokens. Because the token-issuing flow performs no nonce validation and enforces no request expiry, a single intercepted request grants durable administrative control of the gateway. The Appliance edition is affected before 5.36.00.16 and the Application edition before 5.36.00.00; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
External control of file name or path (CWE-73) in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to influence filesystem path resolution, resulting in unauthorized filesystem access. Both the Appliance form factor (versions before 5.36.00.16) and the Application form factor (versions before 5.36.00.00) are affected. Dell has released patched versions and published advisory DSA-2026-382; no public exploit code or active exploitation has been identified at this time.