CVE-2026-81048: Dell ThinOS 10 command injection in adjacent network access

CVE-2026-81048 · Severity: critical · CVSS 9.6 · Published 2026-09-10

Dell ThinOS 10 is a thin client operating system used to run lightweight desktop environments on enterprise computers. A command injection vulnerability allows an unauthenticated attacker on the same network segment to execute arbitrary code with elevated privileges on affected devices. This could enable attackers to compromise entire fleets of thin clients, steal data, or establish persistent backdoors across corporate environments.

Technologies: Dell Latitude 3330, Dell Latitude 3420, Dell Latitude 3440, Dell Latitude 3450, Dell Latitude 5440, Dell Latitude 5450, Dell Latitude 5520, Dell Latitude 5530, Dell Latitude 5540, Dell Latitude 5550, Dell Optiplex 3000 Tc, Dell Optiplex 5400 All-In-One, Dell Optiplex 7020, Dell Optiplex All-In-One 7410, Dell Optiplex All-In-One 7420, Dell Optiplex Micro Plus 7010, Dell Precision 3260 Compact, Dell Precision 3280, Dell Pro 14 Pc14250, Dell Pro 16 Pc16250, Dell Pro 16 Plus Pb16250, Dell Pro 24 All-In-One, Dell Pro 24 All-In-One \(65w\) Qc24250, Dell Pro 24 All-In-One Plus Qb24250, Dell Pro Max 14, Dell Pro Max 16 Plus, Dell Pro Max Microfcm2250, Dell Pro Micro Qcm1250, Dell Pro Micro-Thin Client Q9m1260, Dell Pro Rugged 13 Ra13250, Dell Pro Rugged 14 Rb14250, Dell Pro Slim Low Sff, Dell Pro Slim Plus Xe5 Oem Qbs1250, Dell Pro Tower Plus Xe5 Oem Qbt1250, Dell Pro Tower Qct1250, Dell ThinOS, Dell ThinOS 10, Dell Wyse 5070 Extended Thin Client, Dell Wyse 5070 Thin Client, Dell Wyse 5470 All-In-One Thin Client, Dell Wyse 5470 Mtc. Vendors: Dell.

Quick answers

Is CVE-2026-81048 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81048 being exploited in the wild.
How severe is CVE-2026-81048?
Critical severity, with a CVSS score of 9.6, published 10 September 2026.
Which products and versions are affected?
Dell ThinOS 10 prior to 2605_10.2616.
Is there a fix for CVE-2026-81048?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81048 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-81048?
Check whether you run Dell Latitude 3330, Dell Latitude 3420, Dell Latitude 3440 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper neutralization of special characters in a command string (CWE-78 command injection). An unauthenticated attacker with adjacent network access (AV:A per CVSS 3.1) can exploit this without authentication (PR:N) or user interaction (UI:N) to achieve remote code execution. The attack scope is changed (S:C), meaning impact extends beyond the vulnerable component to the entire system. No patch bypass or mitigation is described; Dell has issued security update version 2605_10.2616 to remediate this and related vulnerabilities identified in DSA-2026-389.

Affected products

  • Dell ThinOS 10 prior to 2605_10.2616

Timeline

  • 2026-09-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.