CVE-2026-25906

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25906", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-02-08T18:05:27.450Z", "datePublished": "2026-03-03T20:55:40.882Z", "dateUpdated": "2026-03-05T04:55:38.765Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Optimizer", "vendor": "Dell", "versions": [{"lessThan": "6.3.1.0", "status": "affected", "version": "6.0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Dell Technologies would like to thank falconCorrup for reporting this issue."}], "datePublic": "2026-03-03T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}], "value": "Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-03T20:55:40.882Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000427608/dsa-2026-094"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-25906"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T04:55:38.765Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25906", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T21:16:44.377679Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T21:16:47.776Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Dell Technologies would like to thank falconCorrup for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Optimizer", "versions": [{"status": "affected", "version": "6.0.0.0", "lessThan": "6.3.1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-03T18:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000427608/dsa-2026-094", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.", "supportingMedia": [{"type": "text/html", "value": "Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-03T20:55:40.882Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25906", "state": "PUBLISHED", "dateUpdated": "2026-03-05T04:55:38.765Z", "dateReserved": "2026-02-08T18:05:27.450Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-03-03T20:55:40.882Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Optimizer", "vendor": "Dell", "versions": [{"lessThan": "6.3.1.0", "status": "affected", "version": "6.0.0.0", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:optimizer:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA233877-A123-4090-BC96-E912F585CA71", "versionEndExcluding": "6.3.1.0", "versionStartIncluding": "6.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}, {"lang": "es", "value": "Dell Optimizer, versiones anteriores a la 6.3.1, contienen una vulnerabilidad de Resoluci\u00f3n de Enlaces Incorrecta Antes del Acceso a Archivos ('Seguimiento de Enlaces'). Un atacante con privilegios bajos y acceso local podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a una Elevaci\u00f3n de Privilegios."}], "id": "CVE-2026-25906", "lastModified": "2026-06-17T10:25:25.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25906", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-03T21:15:58.520", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000427608/dsa-2026-094"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0.0.0,6.3.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Optimizer", "source": "cna", "vendor": "Dell"}, "product": "optimizer", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-16T13:58:25.183466+00:00", "value": {"mitigation_remediation": ["Upgrade Dell Optimizer to version 6.3.1 or later to remove the link resolution flaw.", "Restrict permissions on directories accessed by Dell Optimizer so that non\u2011administrative users cannot create or modify symbolic links or shortcuts that could be exploited during file access.", "Enable system audit logging for file system changes and monitor for unusual link or shortcut creation that could indicate an attempted privilege escalation."], "summary": {"action": "Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Any installation of Dell Optimizer older than version 6.3.1 is affected. This includes all variants of the product distributed under the Dell:Optimizer CPE. Users should verify their installed version and consider the update if they remain on an older build.", "description_and_impact": "An improper link resolution before file access flaw allows a local user to manipulate symbolic or shortcut links, tricking Dell Optimizer into accessing files it should not read or execute. This flaw can result in privilege escalation, giving the attacker higher rights on the system. The weakness is characterized by CWE\u201159.", "risk_and_exploitability": "The CVSS score of 7.3 reflects a moderate to high severity, while the EPSS score of less than 1% indicates a low likelihood of active exploitation at the present time. The vulnerability is not listed in CISA's KEV catalog. Because the attack requires local, low\u2011privileged access, the exploitation vector is limited to users who can run Optimizer or influence its environment, and an attacker would need to create or manipulate a link to trigger the flaw."}}}}, "created": "2026-03-04T14:53:50.641026+00:00", "title": "Improper Link Resolution in Dell Optimizer Enables Local Privilege Escalation", "updated": "2026-04-16T14:00:19.504642+00:00", "vendors": ["dell", "dell$PRODUCT$optimizer"]}