Dell Application Store: Missing authentication for critical function
Summary
Dell Application Store versions prior to 26.05.0.7 lack authentication for a critical function. An unauthenticated attacker on the same network segment (adjacent network access) could potentially execute arbitrary code on the affected device. No user interaction or privileges are required, and the impact on confidentiality, integrity and availability is rated high.
Affected
- Dell Application Store versions prior to 26.05.0.7
- Listed Dell thin clients and IoT devices with Windows 10 IoT Enterprise LTSC 2021 and Windows 11 IoT Enterprise LTSC 2024 (for example Latitude 3440, 5440, 5450, OptiPlex 3000 Thin Client, OptiPlex All-in-One 7410/7420, OptiPlex Micro Plus 7010/7020)
Fixed in
- Dell Application Store version 26.05.0.7 or later (per the CVE description and the Dell advisory table; the exact build on Dell's download page could not be verified)
Workaround
Unknown. The CVE record provides no workaround. Check Dell advisory DSA-2026-411 for interim guidance. If none exists, restrict access to the device management service to trusted hosts and apply network segmentation.
Exploitation
- Not listed in the CISA KEV catalog.
- CISA SSVC data: exploitation none, automatable no.
- No public proof of concept or exploit was found in the research. This does not prove that none exists.
- EPSS score 0.00299.
Our recommendation
- Inventory Dell thin clients and Windows IoT kiosks that run Dell Application Store.
- Update Dell Application Store to version 26.05.0.7 or later, as described in DSA-2026-411. Verify the fixed version in the advisory first.
- Until patched, limit access from the local network segment to trusted hosts and devices.
- Monitor for public exploit code, as the CVE is recent.
- Dell advisory DSA-2026-411 also covers CVE-2026-71170 and CVE-2026-71169; patch them together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DSA-2026-411: Security Update for Dell Application Store for Multiple Vulnerabilities www.dell.com
- OpenCVE: CVE-2026-82166 app.opencve.io
- Strix: CVE-2026-82166 www.strix.ai
- Strix: CVE-2026-71170 www.strix.ai
- Strix: CVE-2026-71169 www.strix.ai
- Dell Application Store user guide (Latitude 5450, Windows 11 IoT LTSC 2024) www.dell.com
- VulDB: CVE-2026-82166 vuldb.com
- CNNVD-2026-29975530 (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:45.
Original description (NVD)
Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to arbitrary code execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.