CVE-2026-24502
Published: 03 March 2026
Summary
CVE-2026-24502 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Dell Command \| Intel Vpro Out Of Band. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL Search Order Hijacking (T1038); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and CM-6 (Configuration Settings).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the vulnerability by requiring timely remediation of flaws through patching the affected Dell Command | Intel vPro Out of Band software.
Enforces secure configuration settings such as safe DLL search order mode to mitigate uncontrolled search path exploitation.
Enforces strict access controls on directories in the application's search path to prevent low-privileged attackers from placing malicious libraries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-427 uncontrolled search path enables local DLL search order hijacking (T1038) for privilege escalation (T1068).
NVD Description
Dell Command | Intel vPro Out of Band, versions prior to 4.7.0, contain an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Deeper analysisAI
CVE-2026-24502 is an Uncontrolled Search Path Element vulnerability (CWE-427) in Dell Command | Intel vPro Out of Band, affecting versions prior to 4.7.0. Published on 2026-03-03, the issue has a CVSS v3.1 base score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts with a changed scope.
A low-privileged attacker with local access can exploit this vulnerability, potentially leading to elevation of privileges on the affected system.
Dell Security Advisory DSA-2026-106 provides details on mitigation and patches: https://www.dell.com/support/kbdoc/en-us/000429179/dsa-2026-106.
Details
- CWE(s)