Link following in Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security…
Priority LOW 31CWE-61Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation
Why it matters now
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security Management Server (Windows) (Dell): 11.8.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security Management Server (Windows) | before 11.8.1 | 11.8.1 | Patch available | CNA |
- Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security Management Server (Windows) VendorDell Affected before 11.8.1 Fixed in 11.8.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:* | before 11.8.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:encryption:*:*:*:*:enterprise:*:*:* | before 11.8.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:* | before 11.8.1 | Vulnerable | Dell |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:dell:endpoint_security_suite_enterprise:*:*:*:*:*:*:*:* Versions before 11.8.1 Vulnerable ·Dell
- cpe:2.3:a:dell:encryption:*:*:*:*:enterprise:*:*:* Versions before 11.8.1 Vulnerable ·Dell
- cpe:2.3:a:dell:security_management_server:*:*:*:*:*:*:*:* Versions before 11.8.1 Vulnerable ·Dell
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Dell Encryption, Dell Endpoint Security Suite Enterprise, Dell Security Management Server (Windows) (Dell) Fixed in 11.8.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39246
- 2026-10-03 Alias added: GHSA-wphq-4xg8-q6m6
References
More Dell Encryption vulnerabilities
- TI-2025-24915 Link following in Dell Encryption CVSS 3.1HIGH 7.8
- TI-2025-24879 Link following in Dell Encryption Admin Utilities CVSS 3.1HIGH 7.8
- TI-2023-15761 Improper access control in Dell Encryption CVSS 3.1HIGH 7.8
- TI-2018-11245 Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability CVSS 3.0HIGH 7.5
- TI-2025-29338 Link following in Dell Encryption CVSS 3.1HIGH 7.3
- TI-2020-04432 Incorrect permission assignment in Dell Encryption Enterprise CVSS 3.1HIGH 7.8
Sources
- CVE-2023-39246 · CVE Program
- CVE-2023-39246 · NVD
- FIRST EPSS
- GHSA-wphq-4xg8-q6m6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences