CVE-2026-32652: Dell AIOps Collector versions prior to 1

Synopsis

Use of Default Credentials in Dell AIOps Collector versions prior to 1.18.3 allows a local, low-privileged attacker with console access to exploit pre-set login credentials and gain unauthorized filesystem access. The vulnerability is reachable only from a local session on the host, requiring an existing low-privilege account rather than network exposure. Successful exploitation gives the attacker read and write access to the filesystem, enabling data disclosure, file tampering, and potential full service disruption. A patched-image rebuild at version 1.18.3 is available on HarborGuard for environments running an affected fresh installation.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationRequired

  Any low-privilege account on the system is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  No action from another user or administrator is required to complete the exploit.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors need to align.

Blast Radius

• Reads files stored on the local filesystem, including configuration files, credentials, and application data.
• Modifies or overwrites persisted files, enabling tampering with application state or injecting malicious content.
• Deletes or corrupts critical filesystem content, causing service disruption or preventing the collector from functioning.
• Gains a foothold for privilege escalation by accessing credential files or writable system paths.