CVE-2026-22284
Published: 17 February 2026
Summary
CVE-2026-22284 is a medium-severity Command Injection (CWE-77) vulnerability in Dell Smartfabric Os10. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22284 is an Improper Neutralization of Special Elements used in a Command (command injection) vulnerability, classified under CWE-77, affecting Dell SmartFabric OS10 Software in versions prior to 10.5.6.12. Published on 2026-02-17, it has a CVSS v3.1 base score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating medium severity with network accessibility but high attack complexity and requirements for high privileges.
A high-privileged attacker with remote access can exploit this vulnerability over the network to achieve arbitrary command execution on the affected system. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, allowing the attacker to potentially compromise the device's functionality and data.
Dell's security advisory DSA-2026-033, detailed at https://www.dell.com/support/kbdoc/en-us/000429181/dsa-2026-033-security-update-for-dell-networking-os10-vulnerabilities, addresses this and related vulnerabilities in Dell Networking OS10, recommending upgrades to version 10.5.6.12 or later for mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7839
Vulnerability details
Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-77) in a remotely accessible Dell OS10 appliance directly enables remote exploitation of a public-facing app (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and neutralization of untrusted input to block command-injection payloads before they reach the OS shell in SmartFabric OS10.
Mandates prompt application of vendor patches (here, upgrade to OS10 10.5.6.12+) that eliminate the improper-neutralization flaw.
Limits the number of accounts that possess the high privileges required to reach the vulnerable remote command interface, reducing the attack surface.