Dell Live Optics Collector: Predictable IV in CBC mode allows information exposure
Summary
Dell Live Optics Collector, a free tool that collects data on IT infrastructure for analysis, generates predictable initialization vectors (IVs) for CBC mode encryption (CWE-329). A local user with low privileges can potentially exploit this to expose information. Remote exploitation is not possible according to the CVSS vector, and no user interaction is required.
Affected
- Live Optics Collector versions prior to 27.3.13.330
- VulDB also lists 27.2.13.310 as affected, which falls within this range
Fixed in
- Upgrade to Live Optics Collector version 27.3.13.330 or later, available on the Dell download page
Workaround
Unknown. No vendor workaround has been identified.
Exploitation
- Not known to be exploited in the wild (OffSeq)
- No public proof-of-concept found in research, which does not rule one out
- VulDB labels the entry with a 0-Day status; the meaning of this marker is unclear
Our recommendation
- Inventory all Live Optics Collector installations, including those operated by partners
- Upgrade to 27.3.13.330 or later and verify the build number
- Until patched, run the collector only on trusted admin workstations or jump hosts, limit local accounts, and delete old output files after upload
- Check the Dell advisory directly, as the exposed data is not yet clear
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-485 Security Update for Dell Live Optics Collector www.dell.com
- VulDB entry 435886 vuldb.com
- OffSeq radar: CVE-2026-86363 radar.offseq.com
- CVE record mirror: CVE-2026-86363 cve.threatint.com
- Dell DSA-2026-221 Live Optics Collector SSL vulnerability (context) www.dell.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:32.
Original description (NVD)
Dell Live Optics Collector, versions prior to 27.3.13.330 contains a Generation of Predictable IV with CBC Mode vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.