CVE-2026-86359

HighCVSS 8.5/10Last modified Sep 17, 2026

Description

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	Repository Manager	< 3.5.2 or later

References

https://www.dell.com/support/kbdoc/en-us/000509459/dsa-2026-419-security-update-for-dell-repository-manager-drm-vulnerability

Timeline

Published: Sep 16, 2026
Last modified: Sep 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-86367.5IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryp CVE-2026-863609.6Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu CVE-2026-863618.2Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privil CVE-2026-863628.2Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local acces CVE-2026-863635.5Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privile CVE-2026-863644.7Dell Live Optics Collector, versions prior to 27.3.8.317 contains a Use of Insufficiently Random Values vulnerability. A low privileged atta CVE-2026-863654.2Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Improper Input Validation vulnerability. A low privileged atta CVE-2026-86377.8A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authent CVE-2026-863756.2Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated at CVE-2026-863777.6Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re CVE-2026-863788.8Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re CVE-2026-863797.2Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1