Is CVE-2026-41116 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41116 being exploited in the wild.

How severe is CVE-2026-41116?

Medium severity, with a CVSS score of 6.3, published 9 June 2026.

Which products and versions are affected?

Dell Inventory Collector Client prior to 13.8.0.

Is there a fix for CVE-2026-41116?

A patch was published on 2026-04-30: Remediated version 13.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41116 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-41116?

Check whether you run Dell Alienware Command Center, Dell Alienware Update, Dell Command | Update or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41116: Dell Inventory Collector Client link following vulnerability

CVE-2026-41116 · Severity: medium · CVSS 6.3 · Published 2026-06-09

Dell Inventory Collector, a component used by various Dell support and update tools to identify system hardware, contains a security flaw. A person with low-level access to a computer could exploit this to write data to restricted files. This could potentially allow an attacker to disrupt system operations or gain higher-level control over the device.

Technologies: Dell Alienware Command Center. Vendors: Dell.

Quick answers

Is CVE-2026-41116 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41116 being exploited in the wild.
How severe is CVE-2026-41116?: Medium severity, with a CVSS score of 6.3, published 9 June 2026.
Which products and versions are affected?: Dell Inventory Collector Client prior to 13.8.0.
Is there a fix for CVE-2026-41116?: A patch was published on 2026-04-30: Remediated version 13.8.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41116 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-41116?: Check whether you run Dell Alienware Command Center, Dell Alienware Update, Dell Command | Update or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Dell Inventory Collector Client, integrated into several Dell management suites (SupportAssist, Optimizer, Command | Update, etc.), is vulnerable to an Improper Link Resolution Before File Access ('Link Following') bug, specifically involving Windows Junctions or Mount Points (CWE-1386). A local, low-privileged attacker can exploit this by creating symbolic links or junctions that redirect the application's file operations to a target file of the attacker's choosing. Successful exploitation leads to an arbitrary file write with the privileges of the Inventory Collector service. The vulnerability is addressed in version 13.8.0, which is typically delivered via automatic updates through the parent Dell software suites.

Affected products

Dell Inventory Collector Client prior to 13.8.0
Dell SupportAssist for PCs (Home and Business)
Dell Optimizer
Dell Trusted Device
Dell Update / Alienware Update
Dell Command | Update
Dell Alienware Command Center

Timeline

2026-04-30: patched: Remediated version 13.8.0 released
2026-06-08: advisory: Initial Dell advisory DSA-2026-215 published
2026-06-09: disclosed: NVD publication date

References

https://www.dell.com/support/kbdoc/en-us/000463760/dsa-2026-215

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.