CVE-2026-81048 is a critical (CVSS 9.6) command injection flaw in Dell ThinOS 10 versions before 2605_10.2616. An unauthenticated attacker on the adjacent network could achieve remote code execution. Update thin clients to 2605_10.2616 or later, and confirm details in Dell advisory DSA-2026-389.
What's affected
- Dell ThinOS 10 versions prior to 2605_10.2616, per the CVE record.
- The record lists many Dell Latitude models as affected products, among them Latitude 3330, 3420, 3440, 3450, 5440, 5450, 5520 and 5530. The list may be longer, so check the Dell advisory for the full set of platforms.
- Fixed in 2605_10.2616 or later. We could not retrieve the Dell advisory page when preparing this post, so the versions here come from the CVE record. Confirm them against the Dell advisory before you act.
Record severity: CVSS 9.6 (critical), vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-77, Command Injection.
How to check if you're exposed
On a ThinOS device, open the system information screen and read the OS version. In your device management console you can report firmware versions across the fleet. Anything below 2605_10.2616 is affected. The adjacent network precondition means devices on the same local segment as untrusted hosts are the priority.
What to do now
- Report the ThinOS version of every thin client.
- Stage the 2605_10.2616 or later package in your management console.
- Roll out in waves, beginning with devices on shared or guest networks.
- Segment thin clients from untrusted hosts on the local network.
- Confirm versions after rollout and record exceptions.
Why it matters
Command injection (CWE-77) means input is used to build a command in a way that lets extra instructions in. The adjacent attack vector in the record means the attacker must share a network segment, such as the same Wi-Fi or switch, with the device. No credentials are needed and the user does not need to do anything, which accounts for the 9.6 score.
Thin clients are often deployed in large numbers with the same firmware, so one flaw spreads across a fleet. Network segmentation and prompt firmware management reduce that. The record does not mark the CVE as exploited in the wild.
Quick check
What does adjacent network access mean?
The attacker must be on the same local network segment as the device, not across the internet.
Which version fixes it?
2605_10.2616 or later, as the record says. Confirm with Dell.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
