CVE-2022-26865 Auth bypass in Dell OS Recovery Tool
An unauthenticated attacker with physical access can bypass authentication to execute arbitrary code as Administrator on systems using Dell Support Assist OS Recovery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-26865?
CVE-2022-26865 is a medium-severity authentication bypass vulnerability in Dell OS Recovery Tool, published on 26 May 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.
Which versions are affected by CVE-2022-26865?
It affects 1 product.
Products include Dell Supportassist Os Recovery.
How do I fix CVE-2022-26865?
No fix has been published for CVE-2022-26865 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-26865 being exploited?
There is no known exploitation of CVE-2022-26865 in the wild and no public exploit code.
Other vulnerabilities in Dell OS Recovery Tool
- CVE-2025-38747 Privilege escalation in SupportAssist OS Recovery
- CVE-2025-46685 Privilege escalation in SupportAssist OS Recovery
- CVE-2025-22480 Path traversal in Dell SupportAssist OS Recovery
- CVE-2025-46684 Other in SupportAssist OS Recovery,
- CVE-2025-46602 Information disclosure in SupportAssist OS Recovery
Sources
Also known as GHSA-8q4m-mmx3-p9jx.