Quick answers
- Is CVE-2026-40715 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40715 being exploited in the wild.
- How severe is CVE-2026-40715?
- High severity, with a CVSS score of 7.8, published 2 June 2026.
- Which products and versions are affected?
- Dell ThinOS Versions prior to 2602_10.0765_T10.
- Is there a fix for CVE-2026-40715?
- A patch was published on 2026-05-15: Remediated firmware versions released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40715 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-40715?
- Check whether you run Dell ThinOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Dell ThinOS 10 versions prior to 2602_10.0765 contain an improper access control vulnerability (CWE-284). The flaw exists within the proprietary code of the operating system. A local attacker with low-level privileges can exploit this weakness to escalate their permissions to a higher level, potentially gaining full administrative control. The attack requires local access but no user interaction. Dell has released remediated firmware versions (2602_10.0765_T10 or later) for affected Latitude, OptiPlex, and Wyse hardware platforms.
Affected products
- Dell ThinOS 10 Versions prior to 2602_10.0765_T10
Timeline
- 2026-05-15: patched: Remediated firmware versions released.
- 2026-06-02: disclosed: Initial advisory publication.