Dell IDRAC9 vulnerabilities

5 CVEs affecting Dell IDRAC9, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-23855, published 2026-09-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-24422, published 2022-05-26. Critical severity, CVSS 9.8. EPSS: 58.5% chance of exploitation in the next 30 days. Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to…
CVE-2026-23855, published 2026-09-09. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used…
CVE-2024-25943, published 2024-06-29. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit…
CVE-2026-79940, published 2026-08-26. Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days. Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could…
CVE-2026-70412, published 2026-08-17. Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days. Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote…