# CVE-2026-86363: Dell Live Optics Collector predictable IV in CBC mode encryption

Source: https://junglewise.ai/threats/cve-2026-86363-dell-live-optics-collector-versions-prior-to-27-3-13-330-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-86363 · Severity: medium · CVSS 5.5 · Published 2026-11-11

Dell Live Optics Collector is a data collection tool used to monitor and optimize infrastructure performance. The software uses weak encryption with predictable initialization vectors in CBC mode, allowing a low-privileged local attacker to decrypt sensitive data stored by the application, potentially exposing confidential information.

Technologies: [Dell Live Optics Collector](https://junglewise.ai/threats/technologies/live-optics-collector). Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-86363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86363 being exploited in the wild.

**How severe is CVE-2026-86363?** Medium severity, with a CVSS score of 5.5, published 11 November 2026.

**Which products and versions are affected?** Dell Live Optics Collector prior to 27.3.13.330.

**Is there a fix for CVE-2026-86363?** Yes: fixed in Version 27.3.13.330 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86363 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-86363?** Check whether you run Dell Live Optics Collector at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Version 27.3.13.330 or later

## Technical details

A generation of predictable IV with CBC mode vulnerability exists in the encryption implementation of Dell Live Optics Collector prior to version 27.3.13.330. A low-privileged attacker with local access can exploit this weakness to recover encrypted data. The vulnerability affects the confidentiality of stored information without requiring special conditions beyond local access and existing low privileges.

## Affected products

- Dell Live Optics Collector prior to 27.3.13.330

## Timeline

- 2026-11-03: advisory
- 2026-11-11: disclosed

## References

- [https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000529138/dsa-2026-485-security-update-for-dell-live-optics-collector-vulnerabilities)

## Related threats

- [Dell Live Optics Collector weak random value generation](https://junglewise.ai/threats/cve-2026-86364-dell-live-optics-collector-versions-prior-to-27-3-8-317-contains)
- [Dell Live Optics Collector hard-coded password vulnerability](https://junglewise.ai/threats/cve-2026-70413-dell-live-optics-collector-versions-prior-to-27-2-13-310-contain)