Critical· 9.6official fix available
CVE-2026-81048
Dell ThinOS 10 versions before 2605_10.2616 allow attackers on the same network to run arbitrary commands, giving them full control of the device.
publishedSep 10, 2026
last modifiedSep 11, 2026
sourcesNVD
severity · cvss
9.6
critical · how bad it is
exploitation · epss
1%
69th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Oct 10, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Dell ThinOS 10 firmware on Dell thin client devices, versions earlier than 2605_10.2616.
02
Real-world impact
An attacker could execute any commands on the device, steal or modify data, install malware, or use the device as a launch point for further attacks.
03
Why this severity
The CVSS score of 9.6 reflects that the flaw can be exploited without authentication, requires only local network access, and grants the attacker complete control over confidentiality, integrity, and availability.
04
What to do about it
official fix available
recommended steps
- 01Check the current ThinOS version on the device.
- 02Download the latest ThinOS firmware (2605_10.2616 or newer) from Dell’s support site.
- 03Install the firmware update following Dell’s instructions and reboot the device.
NVD-referenced vendor advisory
05
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorAdjacent network
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →