← Vulnerability feed

Vulnerability record · CVE-2023-39246 · published 16 November 2023

CVE-2023-39246: Dell endpoint security suite enterprise link following vulnerability

Dell · Endpoint Security Suite Enterprise

Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation

7.3 CVSS 3.1 High EPSS 0.15% · top 96.3% CWE-61 · CWE-61CWE-59 · Link following
7.3CVSS 3.1 base score
0.15%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure Operation on Windows Junction Vulnerability during installation. A local malicious user could potentially exploit this vulnerability to create an arbitrary folder inside a restricted directory, leading to Privilege Escalation

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.dell.com/support/kbdoc/en-us/000217572/dsa-2023-271 Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000217572/dsa-2023-271 Vendor Advisory

Track CVE-2023-39246 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-5327Dell security management server deserialization of untrusted data vulnerabilityDell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is expo…EPSS 3.7%7.8CVE-2025-36611Dell encryption link following vulnerabilityDell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Followi…EPSS 0.14%7.8CVE-2025-36564Dell encryption link following vulnerabilityDell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially…EPSS 0.13%7.8CVE-2023-32479Dell encryption improper access control vulnerabilityDell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation v…EPSS 0.09%7.8CVE-2020-5385Dell encryption incorrect permission assignment vulnerabilityDell Encryption versions prior to 10.8 and Dell Endpoint Security Suite versions prior to 2.8 contain a privilege escalation vulnerability because of…EPSS 0.18%7.8CVE-2020-5358Dell encryption incorrect permission assignment vulnerabilityDell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to inc…EPSS 0.19%7.5CVE-2018-15766Dell encryption weak password requirements vulnerabilityOn install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set th…EPSS 0.55%7.3CVE-2025-46637Dell encryption link following vulnerabilityDell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local maliciou…EPSS 0.10%

Source: NIST National Vulnerability Database (record CVE-2023-39246), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.