---
id: "CVE-2026-81472"
kind: "vulnerability"
aliases: ["CVE-2026-81472"]
title: "Dell iDRAC Service Module: code injection lets a local admin escalate privileges"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dell", "esxi", "idrac", "infrastructure", "linux", "on-prem-servers", "windows"]
not_affected_if: ["ism-not-installed", "version-6.1.1.0-or-later"]
published_at: "2026-10-28T12:17:42+00:00"
first_seen_at: "2026-10-28T12:32:51+00:00"
updated_at: "2026-10-28T12:33:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81472", "first_seen_at": "2026-10-28T12:32:51+00:00"}]
---

# Dell iDRAC Service Module: code injection lets a local admin escalate privileges

Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi contains a code injection flaw in versions before 6.1.1.0. A high-privileged local attacker can exploit it to elevate privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iSM version on each Windows, Linux or ESXi host running the iDRAC Service Module, and confirm whether it is below `6.1.1.0`
- unknown for any other check, as the sources do not say

## Fix

- Upgrade Dell iDRAC Service Module (iSM) for Windows, Linux and ESXi to `6.1.1.0` or later
- unknown for other mitigations, as the sources do not say

## Timeline

- 2026-10-28T12:32:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-81472

## From the sources

Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_