CVE-2026-67267: 
Dell Command Update vulnerability analysis and mitigation

CVE-2026-67267 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability (CWE-497) in Dell Command Update (DCU). It affects all DCU versions prior to 5.7.1 and was disclosed on August 19, 2026, by Dell. A low-privileged local attacker can exploit this flaw to access sensitive system information beyond their privilege level. It carries a CVSS v3.1 base score of 5.5 (Medium), assigned by Dell (Dell Advisory, GitHub Advisory).

The vulnerability is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), meaning Dell Command Update does not properly restrict access to sensitive system-level information from actors with lower privilege levels. Exploitation requires local access and low privileges, with no user interaction needed and low attack complexity. The specific mechanism by which sensitive information is exposed — such as insecure file permissions, unprotected memory regions, or logging of sensitive data — has not been publicly detailed beyond the vendor advisory. No public technical write-ups or proof-of-concept code have been identified (Dell Advisory, GitHub Advisory).

Successful exploitation results in high confidentiality impact, allowing a low-privileged local user to read sensitive system information that should not be accessible at their privilege level. There is no impact to integrity or availability. The scope is unchanged, meaning the impact is confined to the vulnerable component itself; however, disclosed system information could potentially be leveraged to facilitate further attacks or privilege escalation on the affected host (Dell Advisory, GitHub Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation as of the disclosure date. CISA's SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, with only partial technical impact. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Dell Advisory, GitHub Advisory).

Dell has released version 5.7.1 of Dell Command Update (DCU) to address this vulnerability. Organizations should upgrade to DCU 5.7.1 or later as the primary remediation step. As an interim measure, restricting local access to systems running vulnerable versions to trusted users only can reduce exposure risk (Dell Advisory).