CVE-2026-49810: Dell Command PowerShell Provider Log Exposure

CVE-2026-49810 Overview

CVE-2026-49810 affects Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2. The vulnerability stems from insertion of sensitive information into log files [CWE-532]. Dell tracks this issue under advisory DSA-2026-379, which describes a credential theft path via the PowerShell event log.

A local, low-privileged attacker can read sensitive data written to logs during DCPP operations. Successful exploitation leads to information disclosure and, per Dell's advisory, potential credential theft that can be leveraged for further compromise of the host.

Critical Impact
A local user with standard privileges can harvest credentials from PowerShell event logs, enabling privilege escalation and lateral movement on affected Dell-managed endpoints.

Affected Products

Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2

Discovery Timeline

2026-09-21 - CVE-2026-49810 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-49810

Vulnerability Analysis

Dell Command PowerShell Provider exposes BIOS and system configuration operations through PowerShell cmdlets. During execution, DCPP writes operational data to Windows PowerShell event logs. The flaw arises because sensitive information, including credential material used by DCPP, is written into these logs in a form readable by local users with log-read access.

The issue maps to [CWE-532: Insertion of Sensitive Information into Log File]. Exploitation is local and requires low privileges. No user interaction is required, and the attacker operates within the vulnerable component's scope on the affected host.

Root Cause

DCPP does not sanitize or redact sensitive parameters before they reach the PowerShell event log. Command invocations that include or derive credential material are serialized to log records. Because Windows PowerShell operational and script-block logs can be read by accounts holding standard log-read rights, credentials become recoverable through log inspection.

Attack Vector

An attacker with local shell access and low privileges queries the Windows event log for PowerShell channels such as Microsoft-Windows-PowerShell/Operational. The attacker parses event records generated by DCPP cmdlets and extracts credential fragments. Recovered credentials can then be reused for privilege escalation, persistence, or lateral movement.

No verified public proof-of-concept code is available. Refer to the Dell Security Update DSA-2026-379 advisory for vendor technical details.

Detection Methods for CVE-2026-49810

Indicators of Compromise

PowerShell operational or script-block log events referencing DCPP cmdlets that contain credential-like strings, tokens, or password parameters in event message bodies.
Unexpected reads of Microsoft-Windows-PowerShell/Operational or Windows PowerShell event logs by non-administrative user accounts.
Use of Get-WinEvent, wevtutil, or Get-EventLog by low-privileged users targeting PowerShell channels on Dell-managed endpoints.

Detection Strategies

Hunt for process command lines invoking event-log readers with filters that reference PowerShell channels and DCPP module names.
Correlate DCPP cmdlet invocations with subsequent log-read activity from unrelated user sessions within a short time window.
Alert when standard users enumerate or export .evtx files from %SystemRoot%\System32\winevt\Logs\.

Monitoring Recommendations

Enable PowerShell script-block logging with restricted event log ACLs so only administrators can read the resulting channels.
Forward PowerShell and Security event logs to a centralized SIEM for retention and correlation across endpoints.
Baseline expected DCPP usage per host and flag deviations in cmdlet frequency or invoking user context.

How to Mitigate CVE-2026-49810

Immediate Actions Required

Upgrade Dell Command PowerShell Provider to version 2.10.2 or later on every affected endpoint.
Rotate any credentials that may have been passed to DCPP cmdlets on unpatched systems.
Purge historical PowerShell event logs on affected hosts after collecting them for forensic review.

Patch Information

Dell released the fix in DCPP version 2.10.2. Apply the update per Dell's guidance in DSA-2026-379.

Workarounds

Restrict local logon on systems running DCPP to trusted administrative accounts until the patch is deployed.
Tighten access control lists on PowerShell event log channels to deny read access to standard users.
Avoid passing plaintext credentials to DCPP cmdlets; use secure credential objects and just-in-time administration where feasible.

bash

# Verify installed DCPP version and confirm remediation
Get-Module -ListAvailable DellBIOSProvider | Select-Object Name, Version

# Restrict read access to PowerShell operational log to Administrators only
wevtutil sl Microsoft-Windows-PowerShell/Operational /ca:"O:BAG:SYD:(A;;0x7;;;BA)(A;;0x1;;;SO)(A;;0x1;;;SY)"