Dell vulnerabilities
We track 854 vulnerabilities in Dell products across 60+ products. 853 are rated high or critical, and 3 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Dell vulnerabilities
- 9.8 Critical severity
Unity: Improper Neutralization of Special Elements used in an OS Command
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading t
- 7.8 High severity
Unity: Improper Neutralization of Special Elements used in an OS Command
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to C
- 7.8 High severity
Unity: Improper Neutralization of Special Elements used in an OS Command
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to e
- 7.8 High severity
Unity: Improper Neutralization of Special Elements used in an OS Command
Dell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to e
- 9.8 Critical severity
Dell Chassis Management Controller (CMC) for…: Out-of-bounds Write
Dell Chassis Management Controller Firmware for Dell PowerEdge FX2, version(s) prior to 2.40.200.202101130302, and Dell Chassis Management Controller Firmware for Dell PowerEdge VRTX version(s) prior to 3.41.200.202209300499, contain(s) a Stack-based Buffer Ov
- 7.8 High severity
Wyse Proprietary OS (Modern ThinOS): Incorrect Permission Assignment for Critical Resource
Dell ThinOS 2408 and prior, contains an improper permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- 7.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially ex
- 7.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially ex
- 7.8 High severity
SmartFabric OS10 Software: Incorrect Privilege Assignment
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of pri
- 8.8 High severity
SmartFabric OS10 Software: Use of Default Password
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Use of Default Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- 8.4 High severity
SmartFabric OS10 Software: Use of Hard-coded Password
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
- 7.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially ex
- 8.8 High severity
SmartFabric OS10 Software: Execution with Unnecessary Privileges
Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevatio
- 7.8 High severity
Wyse Proprietary OS (Modern ThinOS): Improper Neutralization of Special Elements used in a Command
Dell ThinOS 2411 and prior, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary code execu
- 7.8 High severity
RecoverPoint for VMs: Improper Access Control
Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially exploit this vulnerability by running the specific binary and perform any administrative action permitt
- 8.2 High severity
Dell Client Platform BIOS: Weak Authentication
Dell Client Platform BIOS contains a Weak Authentication vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 7.8 High severity
NetWorker Management Console: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization of server-side vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability a
- 7.8 High severity
Dell SupportAssist OS Recovery: Improper Link Resolution Before File Access
Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevation of Privileges.
- 7.5 High severity
Dell BSAFE SSL-J: Improper Locking
Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentially exploit this vulnerability, leading to a Denial of Service.
- 7.5 High severity
Dell BSAFE SSL-J: Improper Certificate Validation
Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains an Improper certificate verification vulnerability. A remote attacker could potentially exploit this vulnerability, leading to information disclosure.
- 7.8 High severity
UCC Edge: Server-Side Request Forgery
Dell UCC Edge, version 2.3.0, contains a Blind SSRF on Add Customer SFTP Server vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Server-side request forgery
- 7.5 High severity
PowerProtect DD: Use of a Broken or Risky Cryptographic Algorithm
Dell PowerProtect DD, versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.10 contains a use of a Cryptographic Primitive with a Risky Implementation vulnerability. A remote attacker could potentially exploit this vulnerability, leading to Information tamperi
- 7.8 High severity
PowerProtect DD: Insufficient Granularity of Access Control
Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability leading to escalation of privilege.
- 7.1 High severity
PowerProtect DD: Improper Limitation of a Pathname to a Restricted Directory
Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially exploit this vulnerability to gain unauthorized overwrite of OS files stored on the server filesystem
- 7.8 High severity
NetWorker: Unquoted Search Path or Element
Dell NetWorker, version(s) prior to 19.11.0.3, all versions of 19.10 & prior versions contain(s) an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code executi
- 7.0 High severity
Dell Display Manager: Time-of-check Time-of-use (TOCTOU) Race Condition
Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to code execution and possibly privil
- 7.8 High severity
Dell Update Package (DUP) Framework: Improper Handling of Insufficient Permissions or Privileges
Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary remote scripts on the server.
- 7.5 High severity
NativeEdge: Exposure of Sensitive Information Through Metadata
Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- 8.8 High severity
SupportAssist for Home PCs: Improper Link Resolution Before File Access
Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could p
- 7.8 High severity
NativeEdge: Execution with Unnecessary Privileges
Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- 7.1 High severity
PowerStore: Improper Neutralization of Argument Delimiters in a Command
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system
- 7.8 High severity
Inventory Collector Client: Improper Link Resolution Before File Access
Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and un
- 9.8 Critical severity
RecoverPoint for Virtual Machines: Use of a Broken or Risky Cryptographic Algorithm
Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
- 9.8 Critical severity
RecoverPoint for Virtual Machines: Use of Hard-coded Credentials
Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these secrets and reusing
- 9.8 Critical severity
RecoverPoint for Virtual Machines: Improper Restriction of Excessive Authentication Attempts
Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. An improper Restriction of Excessive Authentication vulnerability where a Network attacker could potentially exploit this vulnerability, leading to a brute force attack or a dictionary atta
- 8.8 High severity
RecoverPoint for Virtual Machines: Improper Neutralization of Special Elements used in an OS Command
Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. A low privileged remote attacker could potentially exploit this vulnerability by running any command as root, leading to gaining of root-level access and compromise of
- 8.4 High severity
Wyse Proprietary OS (Modern ThinOS): Improper Neutralization of Special Elements used in a Command
Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution
- 7.0 High severity
Wyse Proprietary OS (Modern ThinOS): Time-of-check Time-of-use (TOCTOU) Race Condition
Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 8.8 High severity
Avamar: Improper Neutralization of Special Elements used in an SQL Command
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access
- 8.8 High severity
Avamar: Improper Neutralization of Special Elements used in an SQL Command
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access