Remanent Data Readable after Memory Erase in Dell iDRAC9 and iDRAC10
CVE-2026-70412

3.5LOW

Key Information:

Vendor

Dell
Status
Idrac9
Idrac10
Vendor
CVE Published:
17 August 2026

What is CVE-2026-70412?

Dell's iDRAC9 and iDRAC10 systems are susceptible to a vulnerability that allows low privileged attackers with remote access to potentially recover sensitive information even after memory has been erased. This risk stems from the presence of residual data that could be exploited to gain unauthorized access to critical information, highlighting the importance of timely updates and security measures.

Affected Version(s)

iDRAC10 0 < 1.20.60.50 or later

iDRAC9 0 < 7.20.30.50 or later

References

https://www.dell.com/support/kbdoc/en-us/000497902/dsa-20...
vendor-advisory

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.