CVE-2026-67268: CWE-611: Improper Restriction of XML External Entity Reference in Dell Dell Command Update (DCU)

CVE-2026-67268 describes an Improper Restriction of XML External Entity Reference vulnerability in Dell Command Update (DCU) prior to version 5.7.1. This vulnerability enables a low privileged local attacker to exploit the XML parser to perform server-side request forgery and escalate privileges on the affected system. The CVSS 3.1 base score is 6.5, reflecting a medium severity with local attack vector, low attack complexity, and no user interaction required. The vulnerability affects versions from 0 up to but not including 5.7.1.

Exploitation of this vulnerability could allow a local attacker with low privileges to perform server-side request forgery and elevate their privileges on the affected system. This could lead to unauthorized access to sensitive resources or system functions. There is no indication of confidentiality or availability impact beyond what is stated. No known exploits in the wild have been reported.

Upgrade Dell Command Update to version 5.7.1 or later, as versions prior to 5.7.1 are affected. Since no official patch link is provided, users should consult Dell's official advisories or support channels to obtain the fixed version. No additional mitigation guidance is provided in the input data.