CVE-2026-22284

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Dell	SmartFabric OS10 Software	>= N/A, < 10.5.6.12

References

https://www.dell.com/support/kbdoc/en-us/000429181/dsa-2026-033-security-update-for-dell-networking-os10-vulnerabilitiesPatch, Vendor Advisory

Timeline

Published: Feb 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-222854.4Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A high privileged attac CVE-2026-22297.5ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits param CVE-2026-22304.3The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 v CVE-2026-2230610.0Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive CVE-2026-22317.2The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and incl CVE-2026-223128.6The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker t CVE-2026-223139.1The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injecti CVE-2026-223166.5A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based B CVE-2026-223177.2A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HT CVE-2026-223184.9A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send overs CVE-2026-223194.9A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters CVE-2026-22327.5The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' para