CVE-2026-81468 is a critical (CVSS 9.1) OS command injection flaw in Dell ThinOS 10 versions before 2605_10.2616. A high privileged attacker with remote access could execute commands. Update thin clients to 2605_10.2616 or later, and confirm the details in Dell advisory DSA-2026-389.
What's affected
- Dell ThinOS 10 versions prior to 2605_10.2616, per the CVE record.
- The record lists many Dell Latitude models, among them 3330, 3420, 3440, 3450, 5440, 5450, 5520 and 5530. Check Dell for the full platform list.
- Fixed in 2605_10.2616 or later. We could not retrieve the Dell advisory page when preparing this post, so the versions here come from the CVE record. Confirm them against the Dell advisory before you act.
Record severity: CVSS 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-78, OS Command Injection.
How to check if you're exposed
Read the ThinOS version on a device through its system information screen, or report firmware versions across your fleet from your management console. Anything below 2605_10.2616 is affected. Also review who holds administrative access to thin client management, since the record says the attacker needs high privileges.
What to do now
- Report the ThinOS version of each thin client.
- Deploy 2605_10.2616 or later through your management console.
- Review which accounts and systems can administer the devices remotely.
- Protect the management console with strong authentication.
- Verify versions after rollout.
Why it matters
OS command injection (CWE-78) arises when input reaches a shell command without being neutralized. Although the vector needs high privileges, the score is critical because the impact covers confidentiality, integrity and availability with a changed scope.
In practice the risk is about management access. If an attacker takes over an administrator account or a management server, this flaw turns that access into command execution on every device it reaches. It is worth patching together with CVE-2026-81048, since both appear in the same Dell advisory. The record does not mark either CVE as exploited in the wild.
Quick check
Does the attacker need to be on the local network?
The record says remote access with high privileges, not adjacency.
Is it in the same advisory as CVE-2026-81048?
Yes, both link to Dell advisory DSA-2026-389.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
