CVE-2026-23856
HighSummary
Moduł usługi iDRAC firmy Dell (iSM) dla systemu Windows w wersjach przed 6.0.3.1 oraz dla systemu Linux w wersjach przed 5.4.1.1 zawiera podatność na niewłaściwą kontrolę dostępu. Atakujący z niskimi uprawnieniami, mający lokalny dostęp, może wykorzystać tę podatność do podniesienia swoich uprawnień.
Risk Assessment
Organizacja może być narażona na ryzyko nieautoryzowanego dostępu do systemów, co może prowadzić do poważnych naruszeń bezpieczeństwa. Wzrost uprawnień przez atakującego może skutkować utratą danych lub przejęciem kontroli nad systemem.
Recommendation
Zaleca się aktualizację modułu iDRAC Service Module do najnowszej wersji, aby usunąć tę podatność. Należy również przeprowadzić audyt dostępu lokalnego do systemów w celu zminimalizowania ryzyka wykorzystania tej luki.
Related vulnerabilities
- CVE-2026-13684Critical
An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-13639Critical
An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks.
- CVE-2026-67101Critical
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
- CVE-2026-67100Critical
HCL BigFix Service Management is affected by SQL Injection and Cross-Tenant Data Exposure vulnerabilities, which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.
- CVE-2026-93467Critical
The OAKlouds developed by HGiga has an Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
- CVE-2026-85878Critical
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
- CVE-2026-69843Critical
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-62874Critical
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-87886HighActively exploited
The vulnerability is a local privilege escalation due to insecure file permissions. It affects Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, and Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.
- CVE-2026-87701Critical
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.