CVE-2026-82163: Dell Command Intel vPro Information Disclosure

CVE-2026-82163 Overview

CVE-2026-82163 is an Incorrect Default Permissions vulnerability [CWE-276] in Dell Command | Intel vPro Out of Band. Versions prior to 4.7.2 assign insecure default permissions to installed resources. A low-privileged local attacker can leverage this misconfiguration to access data intended to be protected, resulting in information disclosure. The flaw does not require user interaction and does not affect integrity or availability of the host. Dell tracks the fix in advisory DSA-2026-377.

Critical Impact
A locally authenticated user with minimal privileges can read sensitive information exposed by Dell Command | Intel vPro Out of Band because of improperly restrictive default file or object permissions.

Affected Products

Dell Command | Intel vPro Out of Band, all versions prior to 4.7.2

Discovery Timeline

2026-09-21 - CVE-2026-82163 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-82163

Vulnerability Analysis

Dell Command | Intel vPro Out of Band manages Intel Active Management Technology (AMT) systems from a management console. The affected versions install files, directories, or configuration objects with permissions broader than required for normal operation. Any local user account on the system inherits read access to these resources, even without administrative rights.

Because the resources may contain configuration data, credentials, or operational metadata used to reach managed endpoints over the Intel vPro out-of-band channel, exposure creates a foothold for further reconnaissance. The scope remains unchanged, meaning the impact is limited to the vulnerable component and its accessible data, without direct escalation or tampering.

Root Cause

The root cause is Incorrect Default Permissions [CWE-276]. The installer or runtime creates artifacts with access control lists that grant broader read rights than the least-privilege principle requires. See the Dell Security Update DSA-2026-377 for vendor-authoritative context.

Attack Vector

Exploitation requires local access and low privileges. An attacker authenticated to the host, such as a standard user or a service account, enumerates the installed paths of Dell Command | Intel vPro Out of Band and reads objects that should have been restricted to administrators or the SYSTEM account. No network access and no user interaction are needed.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-82163

Indicators of Compromise

Standard user accounts reading files, registry keys, or configuration objects under the Dell Command | Intel vPro Out of Band install directory.
Access to AMT-related credential or configuration artifacts by non-administrative principals.
Copy or archive operations targeting the product's data directories by unexpected processes.

Detection Strategies

Audit file system and registry ACLs on the Dell Command | Intel vPro Out of Band installation paths and flag entries granting read access to Users, Authenticated Users, or Everyone.
Enable object access auditing (Windows Event ID 4663) on the product's directories to record reads by non-administrative accounts.
Correlate process creation events with subsequent access to product data paths to identify enumeration behavior.

Monitoring Recommendations

Baseline the installed permission set immediately after patching and alert on drift.
Monitor endpoint telemetry for command-line tools (icacls, Get-Acl, takeown) targeting Dell Command | Intel vPro Out of Band paths.
Track successful reads of configuration files by accounts outside an approved administrative allowlist.

How to Mitigate CVE-2026-82163

Immediate Actions Required

Upgrade Dell Command | Intel vPro Out of Band to version 4.7.2 or later on all managed hosts.
Inventory endpoints running affected versions and prioritize systems shared by multiple interactive users.
Rotate any AMT credentials or configuration secrets that may have been readable prior to remediation.

Patch Information

Dell has released a fixed build in version 4.7.2. Apply the update referenced in the Dell Security Update DSA-2026-377. Patching is the authoritative remediation because it corrects the default permission set applied by the installer.

Workarounds

Restrict interactive and remote logon rights on hosts running affected versions to administrative personnel only.
Manually harden ACLs on the product's installation and data directories to remove read access for non-administrative principals, pending upgrade.
Isolate management workstations that run Dell Command | Intel vPro Out of Band from general-purpose user activity.

bash

# Configuration example: audit and tighten ACLs on the install path (Windows)
icacls "C:\Program Files\Dell\CommandIntelvProOOB"
icacls "C:\Program Files\Dell\CommandIntelvProOOB" /remove:g "BUILTIN\Users"
icacls "C:\Program Files\Dell\CommandIntelvProOOB" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F" "NT AUTHORITY\SYSTEM:(OI)(CI)F"