CVE-2026-67267: 
Dell Command Update vulnerability analysis and mitigation

CVE-2026-67267 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability (CWE-497) in Dell Command Update (DCU). It affects all versions of DCU prior to 5.7.1 and was published on August 19, 2026. A low-privileged local attacker can exploit this flaw to access sensitive system information beyond their privilege level. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Dell Advisory).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning Dell Command Update does not adequately restrict access to sensitive system-level information from lower-privileged users. Exploitation requires local access and low privileges, with no user interaction or elevated complexity needed. The attack vector is local (AV:L), and the scope remains unchanged, limiting the blast radius to the affected system. No public technical write-ups or proof-of-concept code have been identified (GitHub Advisory, Dell Advisory).

Successful exploitation results in unauthorized disclosure of sensitive system information to a low-privileged local user, with no impact on integrity or availability. The confidentiality impact is rated High, meaning an attacker could potentially read sensitive system-level data managed or accessed by Dell Command Update, such as system configuration details or update-related information. The scope is limited to the local system, reducing the risk of lateral movement or broader network compromise (GitHub Advisory, Dell Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for this vulnerability. The EPSS score is approximately 0.102% (1st percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment confirms no known exploitation (GitHub Advisory, Dell Advisory).

Dell has released version 5.7.1 of Dell Command Update (DCU) to address this vulnerability. Organizations should upgrade to DCU 5.7.1 or later as the primary remediation. As an interim measure, restricting local system access to trusted users only can reduce the risk of exploitation on systems running vulnerable versions (Dell Advisory).