CVE-2026-71179

Dell Update Package Framework versions prior to 26.07.03 contain an OS command injection flaw (CWE-78) in which special elements are improperly neutralized before being passed to the operating system. A local, low-privileged attacker can trigger the vulnerability, and the CVSS vector (UI:R) indicates user interaction is required to exploit it. Successful exploitation executes arbitrary OS commands in the context of the update framework, elevating the attacker's privileges with high impact on confidentiality, integrity, and availability. Any Dell client system running the affected framework — typically deployed as part of Dell's client update tooling on consumer and commercial PCs — is affected. No public proof of concept is known and the flaw is not in CISA KEV, so exploitation is not currently observed.

What to do: Upgrade Dell Update Package Framework to version 26.07.03 or later, available via Dell's support site or Dell Command | Update / Dell Update channels. Because exploitation requires local low-privileged access and user interaction, prioritize patching shared, multi-user, and kiosk-style endpoints, and verify the installed framework version on managed Dell clients.