Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-86361 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Dell System Update. Its CVSS base score is 8.2 (High).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-93790
Vulnerability Data
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly requires determining access needs, defining and communicating an access control policy, implementing rules that map rights/restrictions to entities (including consistency with classification), and considering need-to-know, privileged restrictions, segregation, formal authorization, and dynamic factors — which squarely stops most incorrect permission assignments from being exploitable; the bounded remainder is misconfigurations that violate the policy itself.
A.5.18 directly governs the provisioning, review, adjustment and revocation of logical access rights (including for critical resources) according to business needs, policy, SoD and risk, which stops most unintended actors from reading/modifying via incorrect permissions; the bounded remainder is incorrect permission assignments that are not access-right decisions at all (e.g. filesystem umask, ACL syntax errors).
A.8.2 directly controls the allocation, review, expiry, and use of privileged rights (including least-privilege, temporary grants, no generic IDs, and higher authentication), which stops most unintended read/modify cases named by CWE-732; the bounded remainder is non-privileged incorrect permission assignments (e.g. on files or objects that never require privilege).
Requiring explicit configuration of access controls and permissions for files, applications and services counters the assignment of overly permissive default or incorrect file-system rights.
A.8.32's formal change process (impact assessment, authorization, testing per 8.29, documentation, and enforcement across the SDLC) prevents most incorrect permission assignments on critical resources by catching them before or during implementation; the bounded remainder is ad-hoc/emergency changes or post-deployment permission drift outside the managed process.
A.8.4 strictly controls read/write access to source code and associated critical resources per roles/business needs (with audit and change-control integration), directly preventing most unintended read/modify cases in CWE-732; the bounded remainder is misconfigured permissions on non-source-code critical resources (e.g. configs, keys, or runtime artifacts) outside the clause's explicit scope.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.