CVE-2026-80359: Dell BOSS Authentication Bypass Vulnerability

CVE-2026-80359 Overview

CVE-2026-80359 affects Dell Boot Optimized Server Storage (BOSS) controllers prior to version 2.2.13.2038. The flaw resides in the System Management Controller Unit (SMCU) on 17G BOSS-N1 controllers. The on-chip debug and test interface lacks proper access control [CWE-1191]. An unauthenticated attacker with physical access to the hardware can abuse the exposed debug interface to gain unauthorized access to the controller.

Dell published advisory DSA-2026-402 to address the issue in firmware version 2.2.13.2038.

Critical Impact

Physical access to a vulnerable BOSS-N1 controller permits unauthorized access with high impact to confidentiality, integrity, and availability of the boot storage subsystem.

Affected Products

• Dell Boot Optimized Server Storage (BOSS) firmware versions prior to 2.2.13.2038
• Dell 17G BOSS-N1 controllers (SMCU component)
• Dell PowerEdge servers shipped with vulnerable BOSS-N1 modules

Discovery Timeline

• 2026-09-28 - CVE-2026-80359 published to NVD
• 2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-80359

Vulnerability Analysis

The Dell BOSS-N1 controller integrates a System Management Controller Unit (SMCU) that handles low-level management of the boot storage device. Hardware debug and test interfaces on the SMCU remain reachable without authentication or access restrictions. An attacker who can physically touch the controller can connect to this interface and interact with internal controller state.

Successful interaction with the debug interface grants read and write access to controller resources that are normally isolated from the host. This exposes the boot volume, firmware, and management logic to tampering.

Root Cause

The root cause is improper access control on an on-chip debug and test interface, categorized as [CWE-1191]. Production hardware should disable, lock, or authenticate debug interfaces before shipping. On affected BOSS-N1 controllers, the SMCU debug interface accepts commands without verifying the requester.

Attack Vector

Exploitation requires physical access to the server and the BOSS-N1 module. The attacker connects to the exposed debug or test interface on the SMCU using appropriate hardware tooling. No credentials, user interaction, or prior software foothold are required. Scenarios include supply chain tampering, insider threats in a data center, lost or decommissioned hardware, and evil-maid attacks against unattended servers.

No public proof-of-concept exploit is listed for this CVE. Refer to the Dell Security Update DSA-2026-402 for vendor technical details.

Detection Methods for CVE-2026-80359

Indicators of Compromise

• Physical tampering evidence on server chassis, bezels, or BOSS-N1 module seals.
• Unexpected BOSS firmware version strings or mismatched firmware hashes reported by iDRAC inventory.
• Boot volume integrity failures, modified bootloader entries, or unexplained OS reinstallation artifacts on servers using BOSS-N1 for boot.

Detection Strategies

• Compare installed BOSS firmware against the fixed version 2.2.13.2038 across the fleet using iDRAC or OpenManage inventory data.
• Enable and review chassis intrusion detection logs from iDRAC for any physical access events.
• Validate boot chain integrity using Secure Boot and measured boot attestation to detect post-tamper changes.

Monitoring Recommendations

• Ingest iDRAC, Lifecycle Controller, and chassis intrusion events into a central SIEM and alert on tamper or hardware inventory changes.
• Track BOSS firmware versions as a configuration baseline and alert on drift or downgrade.
• Monitor physical access to server rooms, cages, and racks with badge logs and video, correlating with any BOSS or iDRAC hardware events.

How to Mitigate CVE-2026-80359

Immediate Actions Required

• Identify all Dell PowerEdge servers equipped with 17G BOSS-N1 controllers and inventory firmware versions.
• Apply Dell BOSS firmware 2.2.13.2038 or later as directed in advisory DSA-2026-402.
• Enforce strict physical security controls on data center cages, racks, and spare or decommissioned BOSS modules.
• Enable chassis intrusion detection and iDRAC alerting on all affected systems.

Patch Information

Dell has released fixed firmware in BOSS version 2.2.13.2038. Follow the remediation steps in the Dell Security Update DSA-2026-402 advisory. Firmware can be applied through Dell iDRAC, Lifecycle Controller, or Dell System Update utilities.

Workarounds

• No software workaround removes the debug interface exposure; firmware update is the only vendor-supplied remediation.
• Restrict physical access with locked racks, tamper-evident seals, and controlled hardware handling procedures while patching proceeds.
• Securely wipe or physically destroy decommissioned BOSS-N1 modules before disposal to prevent offline attacker access.

# Example: query BOSS firmware version through Dell OpenManage racadm
racadm storage get controllers -o
racadm getversion -f idrac

# Example: schedule a firmware update job referencing a Dell Update Package
racadm update -f BOSS_Firmware_2.2.13.2038.exe