{"id":"CVE-2026-91900","kind":"vulnerability","aliases":["CVE-2026-91900"],"related":[],"title":"Dell Alienware Command Center: custom URL handler lets remote attackers run commands","description":"Dell Alienware Command Center (AWCC), version(s) Versions up to and including 6.14.20.0, contain(s) an Improper Authorization in Handler for Custom URL Scheme vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution, Launch of phishing attacks, and Remote execution.","summary":"Alienware Command Center up to and including 6.14.20.0 has an improper authorization flaw in its custom URL scheme handler. A remote, unauthenticated attacker could use it to run commands, launch phishing, or execute code remotely.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alienware","dell","other","windows"],"not_affected_if":["app-not-installed"],"how_to_check":"- Check the installed Alienware Command Center version against `6.14.20.0` in Settings or Apps and features on Windows","fix":"- Dell Alienware Command Center: move to a version later than `6.14.20.0`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-02T20:18:04+00:00","first_seen_at":"2026-11-02T20:35:38+00:00","triaged_at":"2026-11-02T20:36:40+00:00","updated_at":"2026-11-02T20:36:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-02T20:36:40Z","model":"claude-haiku-5-5","output":{"fix":"- Dell Alienware Command Center: move to a version later than `6.14.20.0`; the exact fixed version is unknown from the sources","reach":"internet","title":"Dell Alienware Command Center: custom URL handler lets remote attackers run commands","impact":"high","summary":"Alienware Command Center up to and including 6.14.20.0 has an improper authorization flaw in its custom URL scheme handler. A remote, unauthenticated attacker could use it to run commands, launch phishing, or execute code remotely.","audience":"everyone","category":"other","nicknames":[],"who_cares":["dell","alienware","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker runs commands on the machine through the app","analyst_note":"Confirm the fixed version and whether a user click is needed to trigger the custom URL scheme, using Dell's security advisory.","how_to_check":"- Check the installed Alienware Command Center version against `6.14.20.0` in Settings or Apps and features on Windows\n- unknown","plain_action":"If you use Alienware Command Center, check its version and update it to the newest release from Dell.","needs_analyst":true,"not_affected_if":["app-not-installed"],"who_is_affected":"Machines running Alienware Command Center version 6.14.20.0 or earlier are described as exposed. The flaw is reached through the app's custom URL scheme, so a link opened in a browser could trigger it. unknown whether systems without the app or with other Dell software are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000701,"input_tokens":4159,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91900':15A,18A '6.14.20.0':30B,70C 'access':88C 'alienwar':2A,19B,23B,59C 'attack':10A,45B,85C,101C 'author':34B,75C 'awcc':62C 'center':4A,25B,61C 'code':56B 'command':3A,12A,24B,51B,60C,96C 'contain':71C 'could':46B,89C 'custom':5A,38B,79C 'cve':13A,16A 'dell':1A,20B,58C 'execut':55B,97C,104C 'exploit':91C 'flaw':35B 'handler':7A,41B,77C 'improp':33B,74C 'includ':29B,69C 'launch':52B,98C 'lead':94C 'let':8A 'phish':53B,100C 'potenti':90C 'remot':9A,43B,57B,87C,103C 'run':11A,50B 'scheme':40B,81C 'unauthent':44B,84C 'url':6A,39B,80C 'use':47B 'version':63C,65C 'vulner':82C,93C 'window':22B","nicknames":[],"mitigations":[],"who_affected":"Machines running Alienware Command Center version 6.14.20.0 or earlier are described as exposed. The flaw is reached through the app's custom URL scheme, so a link opened in a browser could trigger it. unknown whether systems without the app or with other Dell software are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you use Alienware Command Center, check its version and update it to the newest release from Dell.","pkeys":[],"ptokens":[],"labels":["alienware","dell","medium","other","windows"],"first_public_at":"2026-11-02T20:18:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91900","severity":null,"published_at":"2026-11-02T20:18:04+00:00","modified_at":"2026-11-02T20:18:04+00:00","first_seen_at":"2026-11-02T20:35:38+00:00","fetched_at":"2026-11-02T20:35:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}