CVE-2026-40713: Dell ThinOS 10 Improper Access Control – Patch Guide

Technical summary

CVE-2026-40713 is an improper access control vulnerability (CWE-284) in Dell ThinOS 10 that permits unauthenticated physical access to bypass authentication mechanisms and retrieve confidential data. The vulnerability affects all ThinOS 10 releases prior to version 2602_10.0765. The CVSS 3.1 score of 6.1 (MEDIUM) reflects the physical attack vector requirement, though both confidentiality and integrity are rated high once the device is physically compromised.

Business impact

For organizations deploying Dell ThinOS 10 thin clients—particularly in shared or less-secure physical environments—this vulnerability poses a data exposure risk. An attacker with brief physical possession of a device could extract cached credentials, session data, or other sensitive information without authentication. In scenarios where ThinOS devices are deployed in public areas, kiosks, or high-turnover environments, remediation should be prioritized to prevent credential compromise and lateral movement into downstream systems.

Affected systems

Dell ThinOS 10 is affected. Organizations should inventory devices currently running ThinOS 10 versions prior to 2602_10.0765. Check your Dell asset management systems or device telemetry to confirm patch status. No other ThinOS versions or Dell operating systems are mentioned in this advisory.

Exploitability

While the vulnerability does not require user authentication or network access, exploitation mandates physical possession of the device. This meaningfully limits real-world attack surface compared to remote exploits, but does not eliminate risk—particularly in high-traffic facilities or supply chain scenarios. The attack is straightforward once physical access is obtained; no special skills or complex tooling are implied. This vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Dell ThinOS 10 devices to version 2602_10.0765 or later. Verify the patch version through Dell's system management tools or by querying device firmware directly. For devices that cannot be immediately patched, strengthen physical security controls: restrict device access, enable full-disk encryption at the ThinOS firmware level if available, and consider placing devices in locked or monitored areas.

Patch guidance

Obtain the ThinOS 10 2602_10.0765 release or later from Dell's support portal or Dell's update management service. If you use Dell's centralized device management solution, consult your Dell representative for guidance on remote firmware deployment. Test patches in a non-production environment first to confirm compatibility with your deployment and applications. Verify applied patches by checking device firmware version after update; consult Dell's advisory for the definitive patch verification method.

Detection guidance

Review device inventory reports and firmware version lists for any ThinOS 10 instances running versions prior to 2602_10.0765. If forensic investigation is warranted, examine device access logs (if available on ThinOS 10) for any unauthorized local sessions or unusual activity correlating with the vulnerability window. Monitor for unusual data exfiltration or credential misuse on systems that receive traffic from potentially affected ThinOS 10 devices.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The physical access requirement substantially reduces real-world exploitability in most enterprise environments. However, organizations with ThinOS devices in publicly accessible or physically unsecured locations should prioritize remediation to prevent credential theft and lateral movement. The medium CVSS score and lack of known active exploitation support a measured, risk-based rollout rather than an emergency response.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a medium-severity vulnerability driven primarily by the high confidentiality and integrity impact ratings balanced against the requirement for physical device proximity. The attack complexity is low and no privileges are required once physical access is gained, but the attack vector being physical—rather than adjacent or network—significantly caps the severity. Organizations in environments where physical device security is well-controlled may assess local risk as lower; those in open-access settings should weight the risk higher.

Frequently asked questions