CVE-2026-67268
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Dell Command Update (DCU) versions prior to 5.7.1 contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
Risk Assessment
An attacker could gain elevated privileges on the system and make requests to internal network resources, potentially leading to confidentiality and integrity breaches.
Recommendation
Update Dell Command Update to version 5.7.1 or later, which includes fixes for the XXE vulnerability. Restrict local access to the system for unauthorized users.
Other vulnerabilities in Dell Command Update
See all- CVE-2026-67267Medium
Dell Command Update (DCU) versions prior to 5.7.1 contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
- CVE-2026-67266Medium
Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CVE-2026-58565High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
- CVE-2026-58564High
Dell Command Update (DCU) versions prior to 5.7.1 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could exploit this, leading to filesystem access.
- CVE-2026-58562High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Missing Authorization vulnerability. A low privileged attacker with local access could exploit this, leading to unauthorized access.
- CVE-2026-56797High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
- CVE-2026-56796Medium
Dell Command Update (DCU) versions prior to 5.7.1 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- CVE-2026-53477High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
- CVE-2026-49817High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
- CVE-2026-49816High
Dell Command Update (DCU) versions prior to 5.7.1 contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could exploit this, leading to elevation of privileges.
Original NVD description (English source)
Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and Server-side request forgery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS