CVE-2026-23855

HighCVSS 7.2

Published: 09/09/2026(UTC)Updated: 11/09/2026(UTC)Translated: 09/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.93%

59th percentile - higher than 59% of all known CVEs

Summary

Dell iDRAC9 (14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50) and Dell iDRAC10 (17G versions prior to 1.30.30.50) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.

Risk Assessment

The risk includes remote command execution on the management controller, potentially leading to full compromise of the server and infrastructure.

Recommendation

Update iDRAC firmware to patched versions and restrict remote access to iDRAC.

Other vulnerabilities in Dell iDRAC

CVE-2026-70412Low
Dell iDRAC9 versions prior to 7.20.30.50 and Dell iDRAC10 versions prior to 1.20.60.50 contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

Original NVD description (English source)

Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS