CVE-2026-26945 Overview
CVE-2026-26945 is a process control vulnerability affecting Dell Integrated Dell Remote Access Controller (iDRAC) firmware across multiple generations. The flaw resides in iDRAC9 firmware on 14G servers prior to 7.00.00.181, 15G and 16G servers prior to 7.20.10.50, and iDRAC10 firmware on 17G servers prior to 1.20.25.00. An attacker with high privileges and adjacent network access can leverage the weakness to execute arbitrary code on the affected baseboard management controller (BMC). Dell published the issue under advisory DSA-2026-113. The vulnerability is tracked under CWE-114: Process Control.
Critical Impact
Successful exploitation grants code execution within the iDRAC management plane, exposing out-of-band server control and downstream host integrity to compromise.
Affected Products
- Dell iDRAC9, 14G servers — firmware versions prior to 7.00.00.181
- Dell iDRAC9, 15G and 16G servers — firmware versions prior to 7.20.10.50
- Dell iDRAC10, 17G servers — firmware versions prior to 1.20.25.00
Discovery Timeline
- 2026-03-18 - CVE-2026-26945 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-26945
Vulnerability Analysis
The iDRAC is the out-of-band management controller embedded in Dell PowerEdge servers. It provides remote console, power, firmware, and storage management independent of the host operating system. A process control weakness in iDRAC firmware allows an authenticated attacker on an adjacent network segment to influence how the controller loads or invokes processes. The flaw maps to CWE-114: Process Control, which covers conditions where untrusted input alters the search path or execution context of a process. Exploitation results in code execution within the iDRAC service context. Because iDRAC controls firmware updates, virtual media, and host power state, code execution at this layer undermines server integrity below the operating system.
Root Cause
Dell has not disclosed the specific code path. The CWE-114 classification indicates that iDRAC firmware loads or executes a process using a name, path, or library reference that an attacker can manipulate. The condition requires both elevated privileges and adjacent network access, which suggests the attack surface is reachable only through the dedicated management network or shared LOM interface.
Attack Vector
An attacker must first hold high privileges on iDRAC and must reach the controller from an adjacent network. Once those preconditions are satisfied, the attacker triggers the vulnerable process control flow to load attacker-supplied logic. The result is code execution on the BMC with high impact to integrity, partial impact to confidentiality, and partial impact to availability. Refer to the Dell Security Update DSA-2026-113 for vendor-supplied technical context.
Detection Methods for CVE-2026-26945
Indicators of Compromise
- Unexpected iDRAC firmware version mismatches or rollback events recorded in the Lifecycle Controller log.
- Authenticated iDRAC sessions originating from unusual subnets adjacent to the management VLAN.
- New or modified administrative iDRAC accounts not provisioned through change control.
Detection Strategies
- Inventory all PowerEdge servers and compare running iDRAC firmware against the fixed versions 7.00.00.181, 7.20.10.50, and 1.20.25.00.
- Correlate iDRAC syslog forwarding with SIEM rules that flag privileged login bursts and configuration changes.
- Monitor Redfish API calls for unexpected process or firmware operations issued by administrative accounts.
Monitoring Recommendations
- Forward iDRAC syslog and Redfish telemetry to a centralized data lake for retention and correlation.
- Alert on iDRAC firmware update attempts that occur outside approved maintenance windows.
- Track adjacent network traffic to BMC interfaces and baseline normal management station sources.
How to Mitigate CVE-2026-26945
Immediate Actions Required
- Apply the Dell firmware updates referenced in DSA-2026-113 to all affected iDRAC9 and iDRAC10 controllers.
- Audit iDRAC administrative accounts and rotate credentials for any account with Administrator privileges.
- Restrict iDRAC management interfaces to a dedicated, isolated management VLAN.
Patch Information
Dell addresses CVE-2026-26945 in iDRAC9 firmware 7.00.00.181 for 14G platforms, iDRAC9 firmware 7.20.10.50 for 15G and 16G platforms, and iDRAC10 firmware 1.20.25.00 for 17G platforms. Download the appropriate Dell Update Package (DUP) from Dell Support and apply through the Lifecycle Controller, iDRAC web UI, or racadm command line.
Workarounds
- Place iDRAC interfaces behind a jump host and block management access from general-purpose network segments.
- Enforce multi-factor authentication for iDRAC administrative accounts and disable unused local users.
- Disable the shared LOM mode where operationally feasible and use the dedicated iDRAC NIC.
# Verify current iDRAC firmware version using racadm
racadm getversion -f idrac
# Trigger firmware update from a remote Dell Update Package
racadm update -f firmimg.d9 -l //updates.example.local/idrac/
# Restrict iDRAC access to the management subnet only
racadm set iDRAC.IPBlocking.RangeEnable Enabled
racadm set iDRAC.IPBlocking.RangeAddr 10.10.50.0
racadm set iDRAC.IPBlocking.RangeMask 255.255.255.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
