CVE-2026-82162 is a high severity (7.4) improper handling of mixed encoding in Dell Command | Configure before 5.2.3.35. An unauthenticated attacker with network access could potentially gain elevated privileges, though the vector marks attack complexity as high. Dell fixed it in 5.2.3.35, so update.
What's affected
Dell's advisory DSA-2026-378 lists Dell Command | Configure (DCC) versions before 5.2.3.35 on Windows and ARM64. The fixed version is 5.2.3.35 or later. Dell links separate packages for each platform in the advisory. The advisory covers multiple vulnerabilities, so one update addresses the set.
Dell shows a release date of 23 September 2026, and the revision history gives 5 October 2026 as the initial release.
How to check if you're exposed
Command | Configure is a tool for managing BIOS settings on Dell clients, often installed by IT during imaging. Find where it is installed with your endpoint management tool, and check the version in the installed programs list. Compare each to 5.2.3.35.
Check also whether it is part of your standard image, since old images keep reintroducing old versions.
What to do now
- Inventory Dell Command | Configure installs on Windows and ARM64 devices.
- Update to 5.2.3.35 or later using the packages linked in Dell's advisory DSA-2026-378.
- Update your standard images and deployment packages so new devices get the fixed build.
- Confirm the version across the fleet after rollout.
- Subscribe to Dell advisories for the client tools you deploy.
Why it matters
The weakness is CWE-175, improper handling of mixed encoding. Software that accepts text in more than one encoding can interpret the same input two ways, and a check that sees one meaning may be bypassed by a form that has another.
Dell does not publish how the flaw works, and this post does not guess. The vector rates it high on confidentiality and integrity and high on attack complexity. The record is not listed in CISA's KEV catalog.
Quick check
Is this only a risk on servers?
No. The advisory covers Windows and ARM64 client builds. Inventory your endpoints, not just servers.
Sources
Last reviewed: 19 October 2026.
