CVE-2026-81472

Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000523111/dsa-2026-458-security-update-for-dell-idrac-service-module-vulnerability

Configurations

No configuration.

History

28 Oct 2026, 12:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 12:17

Updated : 2026-10-29 11:17

NVD link : CVE-2026-81472

Mitre link : CVE-2026-81472

CVE.ORG link : CVE-2026-81472

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-81472", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81472", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-29T03:57:05.070583Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "iDRAC Service Module for Windows", "versions": [{"status": "affected", "version": "0", "lessThan": "6.1.1.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "iDRAC Service Module for Linux", "versions": [{"status": "affected", "version": "0", "lessThan": "6.1.1.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "iDRAC Service Module for ESXi", "versions": [{"status": "affected", "version": "0", "lessThan": "6.1.1.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-28T12:17:42.417", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000523111/dsa-2026-458-security-update-for-dell-idrac-service-module-vulnerability", "source": "security_alert@emc.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges."}], "lastModified": "2026-10-29T11:17:34.780", "sourceIdentifier": "security_alert@emc.com"}