Vulnpedia
← All CVEs

CVE-2026-81467

CRITICAL 9.8 ALL-YEARS

Published 2026-09-10 · Last modified 2026-09-11 · dell · NVD: Analyzed

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

3.0%chance of exploitation in 30 days · 87th percentile

○ In CISA KEV○ Public exploit / PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

9.8CVSS 3.1 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.

Affected

Vendors Dell

Products Thinos 10 Thinos Latitude 3330 Latitude 3420 Latitude 3440 Latitude 3450 Latitude 5440 Latitude 5450 Latitude 5520 Latitude 5530 Latitude 5540 Latitude 5550 Optiplex 3000 Tc Optiplex 5400 All In One Optiplex 7020 Optiplex All In One 7410 Optiplex All In One 7420 Optiplex Micro Plus 7010 Precision 3260 Compact Precision 3280 Pro 14 Pc14250 Pro 16 Pc16250 Pro 16 Plus Pb16250 Pro 24 All In One Pro 24 All In One \(65w\) Qc24250 Pro 24 All In One Plus Qb24250 Pro Max 14 Pro Max 16 Plus Pro Max Microfcm2250 Pro Micro Thin Client Q9m1260 Pro Micro Qcm1250 Pro Rugged 13 Ra13250 Pro Rugged 14 Rb14250 Pro Slim Low Sff Pro Slim Plus Xe5 Oem Qbs1250 Pro Tower Plus Xe5 Oem Qbt1250 Pro Tower Qct1250 Wyse 5070 Extended Thin Client Wyse 5070 Thin Client Wyse 5470 All In One Thin Client

Weakness (CWE)

  • CWE-78: : Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Affected Software Configurations

VendorProductVersion range
DellThinos< 2605_10.2616

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Sources: NVD · CVE.org · EPSS