{"id":"CVE-2026-81472","kind":"vulnerability","aliases":["CVE-2026-81472"],"related":[],"title":"Dell iDRAC Service Module: code injection lets a local admin escalate privileges","description":"Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.","summary":"Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi contains a code injection flaw in versions before 6.1.1.0. A high-privileged local attacker can exploit it to elevate privileges.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell","esxi","idrac","infrastructure","linux","on-prem-servers","windows"],"not_affected_if":["ism-not-installed","version-6.1.1.0-or-later"],"how_to_check":"- Check the installed iSM version on each Windows, Linux or ESXi host running the iDRAC Service Module, and confirm whether it is below `6.1.1.0`\n- unknown for any other check, as the sources do not say","fix":"- Upgrade Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi to `6.1.1.0` or later\n- unknown for other mitigations, as the sources do not say","status":"open","published_at":"2026-10-28T12:17:42+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","triaged_at":"2026-10-28T12:33:50+00:00","updated_at":"2026-10-28T12:33:50+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-28T12:33:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi to `6.1.1.0` or later\n- unknown for other mitigations, as the sources do not say","reach":"local","title":"Dell iDRAC Service Module: code injection lets a local admin escalate privileges","impact":"medium","summary":"Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi contains a code injection flaw in versions before 6.1.1.0. A high-privileged local attacker can exploit it to elevate privileges.","category":"infrastructure","nicknames":[],"who_cares":["dell","idrac","windows","linux","esxi","on-prem-servers"],"confidence":0.7,"needs_auth":"yes","worst_case":"local admin gains elevated privileges on the host","analyst_note":"","how_to_check":"- Check the installed iSM version on each Windows, Linux or ESXi host running the iDRAC Service Module, and confirm whether it is below `6.1.1.0`\n- unknown for any other check, as the sources do not say","needs_analyst":false,"not_affected_if":["iSM-not-installed","version-6.1.1.0-or-later"],"who_is_affected":"Hosts running Dell iDRAC Service Module (iSM) for Windows, Linux or ESXi at versions prior to 6.1.1.0. The attacker must already hold high privileges with local access on the host, so systems without iSM installed or with the module at 6.1.1.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3384,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-81472':15A,18A '6.1.1.0':47B,85C 'access':103C 'admin':10A 'attack':53B,100C 'code':5A,41B,93C,94C 'contain':39B,86C 'control':89C 'could':104C 'cve':13A,16A 'dell':1A,19B,29B,60C,67C,75C 'elev':58B,111C 'escal':11A 'esxi':20B,38B,81C 'exploit':55B,106C 'flaw':43B 'generat':91C 'high':50B,98C 'high-privileg':49B 'idrac':2A,21B,30B,61C,68C,76C 'improp':88C 'infrastructur':22B 'inject':6A,42B,95C 'ism':33B,64C,71C,79C 'lead':109C 'let':7A 'linux':23B,36B,73C 'local':9A,52B,102C 'modul':4A,32B,63C,70C,78C 'on-prem-serv':24B 'potenti':105C 'prem':26B 'prior':83C 'privileg':12A,51B,59B,99C,113C 'server':27B 'servic':3A,31B,62C,69C,77C 'version':45B,82C 'vulner':96C,108C 'window':28B,35B,66C","nicknames":[],"mitigations":[],"who_affected":"Hosts running Dell iDRAC Service Module (iSM) for Windows, Linux or ESXi at versions prior to 6.1.1.0. The attacker must already hold high privileges with local access on the host, so systems without iSM installed or with the module at 6.1.1.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T12:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81472","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81472","severity":null,"published_at":"2026-10-28T12:17:42+00:00","modified_at":"2026-10-28T12:17:42+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","fetched_at":"2026-10-28T12:32:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}