CVE-2026-64993 is a medium severity (CVSS 6.8) improper certificate validation flaw in the collector of Dell RVTools before 4.8.1. A remote attacker could potentially harm confidentiality and integrity. Update to 4.8.1, and be careful about which networks you run the collector on.
What's affected
- Product: Dell RVTools, a tool for reading VMware vSphere inventory.
- Affected: versions before 4.8.1. Fixed: 4.8.1.
- Component: the collector.
- Weakness: CWE-295, improper certificate validation. CVSS 6.8 (medium), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. - Dell's advisory is DSA-2026-325. It was not retrievable when I reviewed this, so the details here come from the record.
How to check if you're exposed
RVTools is a Windows desktop tool. Check the version in the application's About or Help menu on each machine where it is installed. Anything before 4.8.1 is in range.
Also find the machines that run it and where they sit. An admin workstation that connects to vCenter over a trusted network has less exposure than a machine connecting across untrusted networks. Software inventory tooling can list installs for you.
What to do now
- Find every machine with RVTools installed and note the version.
- Update to 4.8.1 or later using Dell's download.
- Read Dell's advisory DSA-2026-325 for the full details.
- Run the collector only from trusted networks, and make sure it reaches vCenter through a connection you control.
Why it matters
Certificate validation is how a client knows the server it reached is the one it meant to reach. If the collector does not check properly, a party in the path could impersonate the server. The vector shows high attack complexity and a need for user interaction, which explains the medium score.
The weakness is CWE-295. RVTools collects inventory with credentials, which makes a spoofed endpoint more interesting than it first sounds. The record's KEV flag is false.
Quick check
Which version fixes it?
Dell RVTools 4.8.1.
Is a login needed to exploit it?
The vector says no privileges are required, but it does require user interaction and high complexity.
Sources
- Dell advisory DSA-2026-325 (listed in the record, but access was denied when I reviewed it)
Last reviewed: 19 October 2026.
