CVE-2026-79940 Overview
CVE-2026-79940 is an Improper Access Control vulnerability [CWE-284] affecting Dell Integrated Dell Remote Access Controller 9 (iDRAC9) across 14G, 15G, and 16G server generations. The flaw allows an unauthenticated remote attacker to access unauthorized data over the network. Dell tracks this issue under advisory DSA-2026-374 and has released firmware updates that resolve the weakness.
Affected iDRAC9 firmware versions include 14G releases prior to 7.00.00.182 and 15G/16G releases prior to 7.20.30.50. The vulnerability requires no authentication or user interaction, though the attack complexity is high.
Critical Impact
An unauthenticated remote attacker can access unauthorized data on Dell iDRAC9 management controllers, exposing sensitive server management information.
Affected Products
- Dell iDRAC9 14G firmware versions prior to 7.00.00.182
- Dell iDRAC9 15G firmware versions prior to 7.20.30.50
- Dell iDRAC9 16G firmware versions prior to 7.20.30.50
Discovery Timeline
- 2026-08-26 - CVE-2026-79940 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79940
Vulnerability Analysis
The iDRAC9 is Dell's baseboard management controller (BMC) embedded in PowerEdge servers. It provides out-of-band management including remote console, virtual media, power control, and firmware updates. Because iDRAC9 exposes management interfaces over the network, access control failures on this component directly impact server confidentiality and integrity.
CVE-2026-79940 is classified as Improper Access Control [CWE-284]. The controller fails to correctly enforce authorization on one or more request paths. An unauthenticated remote attacker who reaches the iDRAC9 network interface can leverage this weakness to obtain data the attacker should not be able to view.
Dell has not publicly detailed the specific endpoint or protocol involved. Refer to the Dell Security Update DSA-2026-374 for the authoritative technical description.
Root Cause
The root cause is a missing or incorrect authorization check on a network-accessible iDRAC9 interface. The affected firmware trusts a request path that should require authenticated, privileged context. Dell resolved the issue by tightening access enforcement in firmware 7.00.00.182 for 14G and 7.20.30.50 for 15G/16G platforms.
Attack Vector
The attack vector is Network. An attacker sends crafted requests to a reachable iDRAC9 management interface without credentials. The high attack complexity indicates conditions outside the attacker's control must be met, such as specific configuration state or timing. Successful exploitation impacts confidentiality of management-plane data. Note that the published CVSS vector lists an integrity impact rather than confidentiality; operators should treat the exposure as high-value regardless.
No public proof-of-concept is available at the time of publication.
Detection Methods for CVE-2026-79940
Indicators of Compromise
- Unexpected HTTPS or Redfish API requests to iDRAC9 management IP addresses from untrusted network segments.
- iDRAC9 firmware running below 7.00.00.182 (14G) or 7.20.30.50 (15G/16G) in asset inventories.
- Anomalous data egress patterns from BMC subnets to external destinations.
Detection Strategies
- Inventory Dell PowerEdge servers and query iDRAC firmware versions using Redfish API or racadm getversion to identify vulnerable systems.
- Monitor iDRAC9 web and Redfish endpoints for unauthenticated request patterns and unusual response sizes.
- Correlate iDRAC audit logs (Lifecycle Controller logs) with network flow data to identify off-baseline access.
Monitoring Recommendations
- Forward iDRAC9 syslog and Lifecycle Controller events to a central SIEM for continuous review.
- Alert on any inbound connections to iDRAC9 management IPs from outside dedicated out-of-band management VLANs.
- Track firmware version drift across the server fleet to catch systems that miss the DSA-2026-374 update.
How to Mitigate CVE-2026-79940
Immediate Actions Required
- Update iDRAC9 firmware to 7.00.00.182 on 14G platforms and to 7.20.30.50 on 15G and 16G platforms.
- Verify that iDRAC9 interfaces are not exposed to the public internet or general corporate LAN segments.
- Audit iDRAC9 accounts and disable any unused local users.
Patch Information
Dell has released firmware updates addressing this vulnerability. Details, download links, and full version guidance are available in the Dell Security Update DSA-2026-374. Apply updates through Dell Lifecycle Controller, iDRAC firmware update workflow, or Dell OpenManage Enterprise.
Workarounds
- Place iDRAC9 interfaces on a dedicated out-of-band management network with strict ACLs.
- Restrict inbound access to iDRAC9 to a small set of jump hosts used by server administrators.
- Disable unused iDRAC9 services and protocols such as IPMI over LAN if not required.
# Check iDRAC firmware version and restrict management access
racadm getversion
racadm set iDRAC.IPMILan.Enable 0
racadm set iDRAC.IPBlocking.RangeEnable 1
racadm set iDRAC.IPBlocking.RangeAddr 10.10.10.0
racadm set iDRAC.IPBlocking.RangeMask 255.255.255.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
