Dell DSA-2026-239: CVE-2026-23856 Privilege Escalation in iDRAC9 Exposes PowerEdge Server Management Plane

Dell has released security advisory DSA-2026-239 patching a high-severity privilege escalation vulnerability in iDRAC9, the out-of-band remote management controller embedded in Dell PowerEdge servers across multiple generations. CVE-2026-23856, assigned CVSS 8.8, allows an attacker with low-privilege authenticated access to the iDRAC interface to escalate their privileges to Administrator level — providing full control over the server’s management plane independently of, and undetectable by, the host operating system.

Vulnerability Details

The flaw resides in iDRAC9’s role-based access control implementation. Under specific conditions involving the processing of crafted RACADM command sequences, a user with Operator or ReadOnly level credentials can manipulate session state to obtain Administrator rights. The escalation is achievable through the iDRAC web interface, REST API, and RACADM command-line interface — the three standard iDRAC management channels.

Affected iDRAC9 firmware versions:

Note: iDRAC8 and iDRAC7 are not affected by this specific vulnerability, though both are past end-of-support and should be considered broadly unpatched against other vulnerabilities.

Why the Management Plane Matters

The iDRAC management controller operates independently of the host server’s operating system on a dedicated ARM processor with its own firmware, network interface (Dedicated Management Port or shared), and credentials database. iDRAC9 Administrator access confers:

• Server power control — hard power off, reset, and restart independent of the OS
• Virtual console and virtual media — keystroke-level access to the server console and the ability to mount ISO images as virtual drives
• BIOS/UEFI configuration — modification of boot order, Secure Boot settings, and all BIOS parameters
• Firmware update capability — including the ability to downgrade firmware to versions containing known vulnerabilities
• System event log — access to, and the ability to clear, hardware event logs that may contain evidence of prior attack activity
• iDRAC user management — creation of additional Administrator accounts, modification of existing credentials

An attacker who escalates to iDRAC9 Administrator using a low-privilege account — such as a monitoring service account, a help desk account used for thermal monitoring, or credentials obtained through phishing — achieves persistent access to the server that survives OS reinstallation, disk wipe, and conventional incident response procedures. iDRAC firmware implants, while technically complex, have been used by sophisticated threat actors and represent a persistence mechanism that standard EDR and SIEM tooling cannot observe.

Exposure Assessment

iDRAC management interfaces are a persistent gap in enterprise network segmentation. Ideal architecture places iDRAC Dedicated Management Port connections on an isolated management VLAN with no workstation or general server access. In practice:

• Many deployments use iDRAC shared port mode, placing the management interface on the same network as production traffic
• Management VLAN ACLs frequently permit broad access from IT staff workstations to simplify remote administration
• Service accounts used for hardware monitoring (SNMP, IPMI, Redfish) often hold Operator or ReadOnly level iDRAC credentials and are reachable from application servers

Any threat actor with initial access to a corporate network segment that has connectivity to iDRAC interfaces — even read-only monitoring access — should be considered capable of exploiting this vulnerability until patching is confirmed.

Recommended Actions

• Apply iDRAC9 firmware patches immediately — Dell’s advisory provides direct firmware download links; update via RACADM, iDRAC web interface, or Dell Repository Manager
• Audit iDRAC network accessibility — confirm the Dedicated Management Port is isolated to a management VLAN and not reachable from general server or workstation networks; test with a port scan from a representative production server
• Review iDRAC user accounts on all PowerEdge hosts — remove any accounts that do not correspond to current authorised users; rotate all iDRAC credentials as a precaution given the privilege escalation risk
• Disable shared iDRAC port mode where possible — use Dedicated Management Port with physical cable only to the management switch
• Enumerate your PowerEdge fleet by generation — Dell’s affected version table maps to generation, not just firmware version; understand which servers require which patch stream
• Check for unpatched iDRAC8 and iDRAC7 in your estate — these generations are EOL but widespread in older data centre equipment; plan for network isolation as a compensating control where firmware updates are no longer available