CVE-2026-86358 is a medium severity stack based buffer overflow in Dell Update Package Framework before version 26.07.03. The record says an unauthenticated attacker with adjacent network access could potentially achieve remote execution. Dell addresses it in DSA-2026-417, and the fixed framework version is 26.07.03.
What's affected
Affected: Dell Update Package (DUP) Framework versions before 26.07.03. The fixed version, per the record, is 26.07.03.
I could not read Dell's advisory page. It returned "Access Denied" to my automated fetch, so the details below come from the NVD style record, which cites Dell security advisory DSA-2026-417. Check that advisory for the exact list of affected DUP packages, the platforms involved, and any mitigation Dell recommends.
Severity: the record shows CVSS 6.5 (Medium). I have no second score from Dell to compare, so I cannot say whether Dell rates it differently. The record does not mark the CVE as exploited in the wild and it is not in CISA KEV.
How to check if you're exposed
The DUP Framework is part of the machinery that Dell update packages use to install drivers and firmware on Dell systems, so look for it where you run those packages.
Start with Dell's DSA-2026-417 advisory, which should name the affected packages and the version to look for. Then check the DUP files on your management servers, software distribution shares and any golden images. Dell update packages are usually self contained executables, so the framework version travels inside each package you downloaded rather than living in one place on the machine.
If you cannot confirm the version of a package, treat it as affected and replace it with a current download from Dell's support site.
What to do now
- Read Dell advisory DSA-2026-417 and note the affected package list.
- Locate Dell Update Packages on distribution shares, deployment tooling and images.
- Replace old packages with current ones that include Dell Update Package Framework 26.07.03 or later.
- Until replaced, avoid running update packages from untrusted shares and keep the update workflow on trusted network segments.
- Record package versions so you can answer the next advisory quickly.
Why it matters
The weakness is a stack based buffer overflow (CWE-121): data written past the end of a fixed size buffer on the stack. In native code this class can corrupt control data, which is why the record speaks of potential remote execution.
The condition that limits risk is network adjacency. An attacker has to be on the same network segment as the system running the framework, which narrows exposure to people and devices already inside a LAN or sharing a Wi-Fi network. That matters most in shared offices, labs and imaging rooms.
Tools that apply updates run with high privilege, so a flaw in one is attractive even when it is hard to reach. The sensible response is to retire old update packages rather than keep them on a share indefinitely.
Quick check
What is the fixed version?
The record says versions before 26.07.03 are affected, so 26.07.03 or later is the target.
Why is the severity only medium?
The record scores it 6.5, and its vector is adjacent network. Dell's own score was not available to me, so check DSA-2026-417.
Sources
- Dell advisory DSA-2026-417 (cited by the record; the page was not readable by my automated fetch)
- Safeguard Gold entry for CVE-2026-86358
Last reviewed: 18 October 2026.
