Dell SmartFabric OS10: command injection lets a high-privileged remote user run arbitrary OS commands

CVE-2026-35160Firmware, BMC & network fabric+1 more CVEscurated

Impact

An administrator-level account on a Dell SmartFabric OS10 switch can break out of the constrained network CLI and execute arbitrary commands on the underlying switch OS. On a GPU fabric this converts a scoped switch admin credential - the kind handed to network automation, monitoring or a managed-service partner - into full control of a device that carries every tenant's east-west and storage traffic, with the ability to persist below the configuration layer. Because the leaf and spine switches are shared, a single compromised device affects tenants that never touched it. Dell split this across two ids in DSA-2026-322 (CVE-2026-35160 and CVE-2026-63694), same score and same fixed release; the operator action is identical for both.

Who can reach it

Remote over the network, but authentication as a high-privileged (admin-level) OS10 user is required. Realistically this is anyone who can reach the switch management interface and holds admin credentials - so the exposure is governed by management VLAN reach and how widely switch admin accounts are shared.

What to do

Upgrade SmartFabric OS10 to 10.5.6.14 or later per DSA-2026-322. This is a switch image upgrade and reload: plan it per device with the switch out of service, so on a non-redundant fabric leg it means draining or accepting loss of the GPU nodes behind that switch. Until then, restrict management plane reachability and audit who holds admin accounts.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-63694

References

https://nvd.nist.gov/vuln/detail/CVE-2026-35160 https://www.dell.com/support/kbdoc/en-us/000501840/dsa-2026-322-security-update-for-dell-networking-os10-vulnerabilities https://nvd.nist.gov/vuln/detail/CVE-2026-63694

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.