CVE-2026-23855: Dell iDRAC9 and iDRAC10 OS command injection

CVE-2026-23855 · Severity: high · CVSS 7.2 · Published 2026-09-09

Dell iDRAC is a remote management interface that allows IT administrators to monitor and control physical servers out-of-band. A vulnerability in iDRAC permits high-privileged attackers with network access to inject arbitrary OS commands, potentially leading to complete compromise of the managed server. An attacker could gain unauthorized control over server hardware, access sensitive data, or disrupt critical business operations.

Technologies: Dell iDRAC10, Dell iDRAC9. Vendors: Dell.

Quick answers

Is CVE-2026-23855 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23855 being exploited in the wild.
How severe is CVE-2026-23855?
High severity, with a CVSS score of 7.2, published 9 September 2026.
Which products and versions are affected?
Dell iDRAC10 17G versions prior to 1.30.30.50; Dell iDRAC9 14G versions prior to 7.00.00.184; 15G/16G versions prior to 7.30.10.50.
Is there a fix for CVE-2026-23855?
A patch was published on 2026-09-03: Dell security advisory DSA-2026-392 issued with remediation versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23855 attacked?
It is attacked over the network.
Am I affected by CVE-2026-23855?
Check whether you run Dell iDRAC10 or Dell iDRAC9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection (CWE-78) in Dell iDRAC9 (14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50) and iDRAC10 (17G versions prior to 1.30.30.50). It requires high privilege authentication and remote network access, but allows an authenticated attacker to execute arbitrary OS commands on the managed server. The attack is straightforward with no additional complexity (AC:L), and impacts confidentiality, integrity, and availability. Patches are available: iDRAC9 14G should update to 7.00.00.184 or later, iDRAC9 15G/16G to 7.30.10.50 or later, and iDRAC10 17G to 1.30.30.50 or later.

Affected products

  • Dell iDRAC9 14G versions prior to 7.00.00.184; 15G/16G versions prior to 7.30.10.50
  • Dell iDRAC10 17G versions prior to 1.30.30.50

Timeline

  • 2026-09-09: disclosed: CVE-2026-23855 published
  • 2026-09-03: patched: Dell security advisory DSA-2026-392 issued with remediation versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.