{"id":"CVE-2026-71170","kind":"vulnerability","aliases":["CVE-2026-71170"],"related":[],"title":"Dell Application Store: uncontrolled path lets local users run code","description":"Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution.","summary":"Dell Application Store versions before 26.05.0.7 resolve a file path without restricting it, so a low-privileged local user can plant or redirect a file. This can lead to privilege escalation and arbitrary code execution.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell","endpoint","other","windows"],"not_affected_if":["version-26.05.0.7-or-later"],"how_to_check":"- Check the installed Dell Application Store version in its About dialog or installed programs list, and compare against `26.05.0.7`\n- unknown for any further file or setting to inspect; the sources do not say which path is affected","fix":"- Update Dell Application Store to `26.05.0.7` or later, per Dell's advisory (source: NVD)","status":"open","published_at":"2026-10-19T20:20:03+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:10:14+00:00","updated_at":"2026-10-25T03:10:14+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:10:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update Dell Application Store to `26.05.0.7` or later, per Dell's advisory (source: NVD)","reach":"local","title":"Dell Application Store: uncontrolled path lets local users run code","impact":"high","summary":"Dell Application Store versions before 26.05.0.7 resolve a file path without restricting it, so a low-privileged local user can plant or redirect a file. This can lead to privilege escalation and arbitrary code execution.","category":"other","nicknames":[],"who_cares":["dell","windows","endpoint"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains elevated privileges and runs arbitrary code","analyst_note":"Find Dell's security advisory for CVE-2026-71170 to confirm the affected path, the exploit preconditions, and the fixed installer.","how_to_check":"- Check the installed Dell Application Store version in its About dialog or installed programs list, and compare against `26.05.0.7`\n- unknown for any further file or setting to inspect; the sources do not say which path is affected","needs_analyst":true,"not_affected_if":["version-26.05.0.7-or-later"],"who_is_affected":"Systems running Dell Application Store before `26.05.0.7`, most likely Dell-managed workstations where the store is installed. The sources do not describe the exact path or configuration needed, so the scope beyond version is unknown. Systems with the store already at `26.05.0.7` or later are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000603,"input_tokens":3310,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-71170':13A,16A '26.05.0.7':26B,63C 'access':76C 'applic':2A,22B,58C 'arbitrari':54B,89C 'attack':73C 'code':10A,55B,90C 'contain':64C 'could':77C 'cve':11A,14A 'dell':1A,17B,21B,57C 'element':68C 'elev':85C 'endpoint':18B 'escal':52B 'execut':56B,91C 'exploit':79C 'file':29B,46B 'lead':49B,82C 'let':6A 'local':7A,39B,75C 'low':37B,71C 'low-privileg':36B 'path':5A,30B,67C 'plant':42B 'potenti':78C 'prior':61C 'privileg':38B,51B,72C,87C 'redirect':44B 'resolv':27B 'restrict':32B 'run':9A 'store':3A,23B,59C 'uncontrol':4A,66C 'user':8A,40B 'version':24B,60C 'vulner':69C,81C 'window':20B 'without':31B","nicknames":[],"mitigations":[],"who_affected":"Systems running Dell Application Store before `26.05.0.7`, most likely Dell-managed workstations where the store is installed. The sources do not describe the exact path or configuration needed, so the scope beyond version is unknown. Systems with the store already at `26.05.0.7` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:20:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-71170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71170","severity":null,"published_at":"2026-10-19T20:20:03+00:00","modified_at":"2026-10-20T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}