CVE-2026-23855High· 7.2▾ Twilight

Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.3 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 9, 2026

Updated

Sep 11, 2026

CVSS

7.2

Vendor

Dell

Product

iDRAC9

CWE

CWE-78

Depth score

40 · Moderate

EPSS

1.4% · p72

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-10

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Sep 11.

0.9% → 1.4%▲ 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 47 days

Sep 9, 2026Published
Disclosed via CVEORG
Sep 11, 2026Record revised
Last analysed / modified upstream
Sep 11, 2026EPSS first tracked
0.9%
Oct 26, 2026EPSS peak
0.9% → 1.4%

Dell CWE-78 #cve.org

Affected

iDRAC9 < 7.30.10.50 or later
iDRAC9 < 7.00.00.184 or later
iDRAC10 < 1.30.30.50 or later

Full technical detail▾

Overview

Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.

Affected

iDRAC9 < 7.30.10.50 or later
iDRAC9 < 7.00.00.184 or later
iDRAC10 < 1.30.30.50 or later

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

https://www.dell.com/support/kbdoc/en-us/000504998/dsa-2026-392-security-update-for-dell-idrac9-and-idrac10-vulnerability

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

← Back to feed

CVE-2026-23855High· 7.2▾ Twilight

Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.3 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 9, 2026

Updated

Sep 11, 2026

CVSS

7.2

Vendor

Dell

Product

iDRAC9

CWE

CWE-78

Depth score

40 · Moderate

EPSS

1.4% · p72

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-10

Exploitation: none
Automatable: no
Technical impact: total

EPSS history

Exploit-prediction probability, daily snapshots since Sep 11.

0.9% → 1.4%▲ 0.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 47 days

Sep 9, 2026Published
Disclosed via CVEORG
Sep 11, 2026Record revised
Last analysed / modified upstream
Sep 11, 2026EPSS first tracked
0.9%
Oct 26, 2026EPSS peak
0.9% → 1.4%

Dell CWE-78 #cve.org

Affected

iDRAC9 < 7.30.10.50 or later
iDRAC9 < 7.00.00.184 or later
iDRAC10 < 1.30.30.50 or later

Full technical detail▾

Overview

Affected

iDRAC9 < 7.30.10.50 or later
iDRAC9 < 7.00.00.184 or later
iDRAC10 < 1.30.30.50 or later

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

https://www.dell.com/support/kbdoc/en-us/000504998/dsa-2026-392-security-update-for-dell-idrac9-and-idrac10-vulnerability

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org