# CVE-2026-91900: Dell Alienware Command Center improper authorization in custom URL handler

Source: https://junglewise.ai/threats/cve-2026-91900-dell-alienware-command-center-awcc-version-s-versions-up-to-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-91900 · Severity: medium · CVSS 5.8 · Published 2026-11-02

Dell Alienware Command Center is system software for managing gaming PC settings and performance. An unauthenticated attacker can exploit a flaw in how the application handles custom URL schemes to execute arbitrary commands, launch phishing attacks, or gain remote control of an affected system. Exploitation requires user interaction, such as clicking a malicious link.

Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-91900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91900 being exploited in the wild.

**How severe is CVE-2026-91900?** Medium severity, with a CVSS score of 5.8, published 2 November 2026.

**Which products and versions are affected?** Dell Alienware Command Center (AWCC) up to and including 6.14.20.0.

**Is there a fix for CVE-2026-91900?** Yes: fixed in 6.14.54.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91900 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-91900?** Check whether you run Dell Alienware Command Center (AWCC) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.14.54.0

## Technical details

The vulnerability is an improper authorization flaw in the custom URL scheme handler of Dell Alienware Command Center versions up to 6.14.20.0. An unauthenticated remote attacker can craft a malicious URL that, when clicked by a user, bypasses authorization checks and leads to command execution or arbitrary code execution. The attack requires user interaction (clicking a link) but no authentication or privilege from the attacker.

## Affected products

- Dell Alienware Command Center (AWCC) up to and including 6.14.20.0

## Timeline

- 2026-11-02: disclosed

## References

- [https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000512248/dsa-2026-429-security-update-for-dell-alienware-command-center-6-x-for-multiple-vulnerabilities)