Dell iDRAC9 SSO Memory Exhaustion

Executive summary #

An unauthenticated network attacker can cause unbounded growth of a file in RAM on iDRAC9 by sending data to the SSO/Negotiate login handler. This can exhaust BMC memory. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3, Medium), and is an instance of CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling).

Technical details #

Before authentication, the fcgi-auth handler initiateSSOLogin appends the value of an Authorization: Negotiate header to a file on tmpfs. The file is opened in append mode, with no size limit or truncation, so each request adds more attacker-controlled data. The affected behavior is present on iDRAC9 7.20.10.50 and absent from iDRAC10 1.30.10.50.

Attacker value #

Repeated requests can consume tmpfs space backed by BMC RAM, potentially degrading or interrupting management functions. The file also retains the supplied data in cleartext on the device.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-16 (Thu): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65186 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-08-31 (Mon): Vendor acknowledged receipt, reserved CVE transferred
• 2026-10-26 (Mon): This public disclosure