Dell iDRAC9/10 Persistent Data Read Vulnerability Advisory

DSA-2026-348: Dell iDRAC9 and iDRAC10 Vulnerability Security Update Vulnerability Overview CVE ID: CVE-2026-70412 CVSS Score: 3.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Vulnerability Description: Dell iDRAC9 and iDRAC10 in certain versions contain a persistent data readability vulnerability that remains present after memory erasure. Low-privilege attackers leveraging this vulnerability via remote access may exploit it to cause information disclosure. Affected Products Affected Products: - iDRAC9 - iDRAC10 - iDRAC9, AX-660, Dell XC Core XC670, Dell XC Core XC6715, Dell XC Core XC770, iDRAC10 - 1.10.xx Series, iDRAC10 - 1.20.xx Series, iDRAC10 - 1.30.xx Series, OEMR R250, OEMR R250, OEMR R250, OEMR R350, OEMR R350, OEMR R360, OEMR XE R360, OEMR R450, OEMR R550 Remediation iDRAC9: - Affected Versions: Versions prior to 7.20.30.50 - Fixed Version: 7.20.30.50 or later - Link: iDRAC 7.20.30.50 iDRAC10: - Affected Versions: Versions prior to 1.20.60.50 - Fixed Version: 1.20.60.50 or later - Link: iDRAC 1.20.60.50 Revision History Revision: 1.0 Date: 2026-08-10 Description: Initial release Related Links Dell Security Advisories and Notifications Dell Vulnerability Response Policy CVSS Scoring Guide Legal Disclaimer The information in this Dell Technologies Security Advisory should be read and used to help avoid situations that may arise from the described issue. Dell Technologies distributes security advisories to convey important security information to users of affected products. Dell Technologies evaluates the average risk across a range of installed systems and may not reflect the actual risk of your local installation and individual environment. All users are advised to determine the applicability of this information to their individual environment and take appropriate action. This information is provided "as is" without warranty of any kind, either express or implied, including but not limited to implied warranties of merchantability, fitness for a particular purpose, and non-infringement. In no event shall Dell Technologies, its affiliates, or suppliers be liable for any direct, indirect, incidental, consequential, commercial profit, or special damages arising out of the use or inability to use the information contained herein, even if Dell Technologies, its affiliates, or suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for incidental or consequential damages, so the above limitation may not apply.

Goal Reached Thanks to every supporter — we hit 100%!

Dell iDRAC9/10 Persistent Data Read Vulnerability Advisory