Dell OpenManage Enterprise CVE-2026-111498

Exploitation requires high-privileged local access to a host running Dell OpenManage Enterprise prior to version 4.8.0 (AV:L, PR:H); it is not remotely reachable and does not work against an unprivileged user. The flaw is an improper resource-locking condition (CWE-413) leading to a protection-mechanism bypass, but the exact feature/configuration that triggers the lock mishandling is not described in the available sources. Limiting factors that reduce real-world risk: the attacker must already be authenticated with high privileges, access must be local, and high attack complexity (AC:H) indicates exploitation is not straightforward or reliably repeatable.

This is a low-to-moderate priority issue despite being tracked for action. The CVSS 3.1 base score is 4.7 (Medium) with a vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) that stacks multiple barriers against exploitation: local-only attack vector, high attack complexity, and high privileges already required. The outcome is a protection-mechanism bypass (CWE-413, Improper Resource Locking) with low integrity and high availability impact and no confidentiality impact. There is no CISA KEV listing, so there is no confirmed active exploitation; no EPSS score was supplied in the input, so exploitation probability cannot be quantified here; and no public exploit or PoC reference is present (the sole reference is the Dell DSA-2026-467 vendor advisory). The vuln.today decision label is 'this_month' rather than act_now/emergency, which is consistent with the modest score and absence of exploitation signals. One data tension worth noting: the input Tags label this 'Authentication Bypass,' but the CVSS and description describe a privileged local actor bypassing a protection mechanism (not gaining unauthenticated access) - treat the 'Authentication Bypass' label with caution. Net: a real but lower-tier fix-this-month item, not a drop-everything emergency, because an attacker must already hold high privileges on the local host.

An attacker who already holds high-privileged local access on a host running Dell OpenManage Enterprise (prior to 4.8.0) abuses an improper resource-locking condition to bypass a protection mechanism, degrading availability and allowing limited integrity impact. No public exploit code or PoC reference is available, and the high attack complexity means exploitation is not reliably repeatable. The specific trigger is not described in the available sources.