CVE-2025-36604: Dell Unity OS Command Injection Allows Unauthenticated Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, high EPSS, and public exploit code make this an urgent pre-auth RCE risk.

What it is

Dell Unity versions 5.5 and prior contain an OS command injection flaw (CWE-78) in the Unity Operating Environment. An unauthenticated remote attacker can inject special elements into an OS command, leading to arbitrary command execution. With a CVSS base score of 9.8 and no authentication or user interaction required, this is a severe pre-auth remote code execution issue.

Impact

An attacker gains arbitrary command execution on the affected Dell Unity system, likely with the privileges of the vulnerable service. This can lead to full compromise of the appliance, including data access, configuration changes, and use as a foothold into the network.

Attack surface

The vulnerability is reachable over the network (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), per the CVSS vector. Any remote attacker who can reach the exposed service can attempt exploitation.

Exploitation

The CVE is not listed in CISA KEV, but EPSS indicates a high probability of exploitation (0.63, 99th percentile). Public references include a watchTowr Labs technical write-up and a GitHub proof-of-concept repository, indicating public exploit code and analysis exist.

What to do

• Apply the Dell security update referenced in DSA-2025-281 for Dell Unity, UnityVSA, and Unity XT as soon as possible.
• If patching cannot be done immediately, restrict network access to the affected Dell Unity management or service interfaces to trusted hosts only.
• Monitor vendor advisories for updated fixed versions and any additional mitigation guidance.
• Segment affected appliances from untrusted networks and limit exposure to the internet.
• After patching, review logs for signs of prior exploitation and reset credentials if compromise is suspected.

Detection

• Monitor for unusual child processes spawned by Dell Unity services, especially command shells or system utilities.
• Inspect network traffic to Dell Unity management interfaces for command injection patterns or anomalous requests.
• Review system and application logs for unexpected command execution, errors, or service restarts.
• Use the public watchTowr proof-of-concept to build detection signatures for known exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.