Dell OpenManage Enterprise CVE-2026-101210

Exploitation requires an already-authenticated high-privileged (administrative) account on Dell OpenManage Enterprise reachable over the network (PR:H, AV:N, UI:N), on versions prior to 4.8.0. The specific product feature, endpoint, or input field that passes data into the OS command is not described in the available sources. The principal limiting factor is the high-privilege authentication requirement, which confines realistic exploitation to insiders, compromised admin credentials, or chaining from a separate privilege-escalation flaw; upgrading to 4.8.0 removes the vulnerability.

This is a genuine but conditional priority rather than an internet-scale emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) shows network-reachable, low-complexity exploitation with full confidentiality/integrity/availability impact, but PR:H is the decisive limiter: an attacker must already hold a high-privileged (administrative) account on OpenManage Enterprise before the OS command injection can be reached. No EPSS probability was supplied, there is no CISA KEV listing, and no public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals are consistent (moderate severity, no exploitation evidence) rather than conflicting. The vuln.today decision label is 'this_week', which aligns with a patch-this-week posture and not an act_now/emergency escalation. The main caveat: because exploitation already assumes administrative access, real-world risk is dominated by privilege-escalation or post-compromise abuse of a management console that controls fleets of servers, so the impact ceiling is high even though the access barrier is also high.

An attacker who has obtained high-privileged (administrative) credentials on a remotely reachable Dell OpenManage Enterprise console sends a crafted request to a function that passes attacker-influenced input into an OS command, achieving arbitrary command execution on the OME host. Because OME is a central infrastructure-management platform, such execution can be leveraged to pivot against the managed server fleet. No public exploit identified at time of analysis, and the specific triggering feature is not described in the available sources.