How severe is CVE-2026-86358?

CVE-2026-86358 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-86358 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-86358?

CVE-2026-86358 affects Dell Update Package Framework. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-86358?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-86358 published?

CVE-2026-86358 was published on 2026-09-16 and last updated on 2026-09-21.

CVE-2026-86358

CVE-2026-86358 is a medium-severity vulnerability in Dell Update Package Framework with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-121.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-121
Affected product: Dell Update Package Framework
Published: 2026-09-16
Last modified: 2026-09-21

Description

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution.

Frequently asked questions

What is CVE-2026-86358?: Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution.
How severe is CVE-2026-86358?: CVE-2026-86358 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-86358 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-86358?: CVE-2026-86358 affects Dell Update Package Framework. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-86358?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-86358 published?: CVE-2026-86358 was published on 2026-09-16 and last updated on 2026-09-21.

References

https://www.dell.com/support/kbdoc/en-us/000509455/dsa-2026-417-security-update-for-dell-update-package-dup-framework-vulnerabilities

Affected products (1)

cpe:2.3:a:dell:update_package_framework:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Update Package Framework

CVE-2026-71180 — High (CVSS 8.2): Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low…
CVE-2026-23857 — High (CVSS 8.2): Dell Update Package (DUP) Framework, versions 23.12.00 through 24.12.00, contains an Improper Handling of Insufficient…
CVE-2025-22395 — High (CVSS 8.2): Dell Update Package Framework, versions prior to 22.01.02, contain(s) a Local Privilege Escalation Vulnerability. A…
CVE-2026-71179 — High (CVSS 7.3): Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used…
CVE-2023-39254 — Medium (CVSS 6.7): Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user…
CVE-2019-3726 — Medium (CVSS 6.7): An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file…

All CVEs affecting Dell Update Package Framework →

Other CWE-121 (Stack-based Buffer Overflow) vulnerabilities

CVE-2026-7866 — Critical (CVSS 10.0): Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This…
CVE-2026-12848 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12847 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12846 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12485 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-37541 — Critical (CVSS 10.0): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length…

Browse all CWE-121 (Stack-based Buffer Overflow) vulnerabilities →