Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.5

Dell iDRAC9 and iDRAC10: Data Exposure After Memory Erase

CVE-2026-70412 · published 2 months ago
Summary

Dell's iDRAC9 and iDRAC10 management tools have a security issue that allows a low-privilege attacker with remote access to potentially access sensitive information even after the memory has been erased. This could lead to the exposure of confidential data. Dell recommends updating to the latest version to fix this issue.

What to do
  • Update dell idrac9 to version 7.20.30.50 or later or later.
  • Update dell idrac10 to version 1.20.60.50 or later or later.
Affected software
VendorProductAffected versions
dell idrac9 < 7.20.30.50 or later
dell idrac10 < 1.20.60.50 or later
Original advisory text
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote ac...
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.5 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-1330Remanent Data Readable after Memory Erase
Timeline
Published17 Aug 2026
Updated4 Nov 2026
First seen17 Aug 2026
Sources
CVE-2026-70412 · NVD
CVE-2026-70412 · MITRE
Track software like this
Free during beta