Improper Access Control in Dell iDRAC Service Module for Windows and Linux
CVE-2026-23856

7.8HIGH

Key Information:

Vendor

Dell
Status
Idrac Service Module
Idrac Service Module For Linux
Vendor
CVE Published:
12 February 2026

What is CVE-2026-23856?

The Dell iDRAC Service Module for both Windows and Linux is affected by an improper access control vulnerability. This flaw allows a low-privileged attacker with local access to exploit the system, potentially leading to unauthorized elevation of privileges. To mitigate this risk, it is crucial for users to update their installations to the latest versions. For more information, visit the vendor advisory.

Affected Version(s)

iDRAC Service Module < 5.4.1.1

iDRAC Service Module < 6.0.3.1

iDRAC Service Module for Linux < 5.4.1.1

References

https://www.dell.com/support/kbdoc/en-us/000426282/dsa-20...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.