Dell OpenManage Enterprise CVE-2026-111503

Exploitation requires an authenticated low-privileged user account on the Dell OpenManage Enterprise management console (CVSS PR:L), reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L) against versions prior to 4.8.0. The limiting factor is the authentication requirement: the attacker must already possess valid console credentials, so exposure depends on how many accounts exist and whether the console is network-restricted to administrators. The specific injectable parameter or console feature is not described in the available sources. Remediation is the vendor update to version 4.8.0 or later per DSA-2026-467; no other mitigation is stated in the supplied evidence.

This is a credible mid-tier priority driven mostly by signal convergence rather than any single alarming indicator. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a remotely reachable, low-complexity flaw that requires authentication (PR:L), so an attacker needs a valid low-privileged account on the OpenManage Enterprise console before exploitation - a meaningful barrier against opportunistic internet-wide attack. No EPSS score, CISA KEV listing, or exploit/PoC reference is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the urgency signal here is the vendor/feed Decision label of 'this_week', which indicates prompt patching rather than emergency response. Note an internal inconsistency to verify with the vendor: the description states the impact is 'Information exposure' (a confidentiality outcome) yet the supplied CVSS vector sets C:L and I:H - the high-integrity flag is inconsistent with a pure information-disclosure SQL injection and should be confirmed against the Dell advisory. SSVC-style framing is not provided in the input. Overall: a real, patch-this-cycle issue because authentication requirements and the absence of any exploit evidence argue against treating it as an emergency, but SQL injection reachable by any low-privileged user of a systems-management console warrants timely remediation.

An attacker who already holds a low-privileged account on the Dell OpenManage Enterprise web console submits crafted input to a parameter that is concatenated into a backend SQL query, causing the database to return data the account should not be able to read. Because the CVSS vector is PR:L/UI:N, no administrator rights and no victim interaction are needed - only authenticated network access to the console. No public exploit or PoC reference is present in the supplied data.