What is the CVSS score of CVE-2026-46461?

CVE-2026-46461 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dell Server Hardware Manager are affected by CVE-2026-46461?

Dell Server Hardware Manager prior to version 3.2.2 contains a privilege escalation vulnerability that allows authenticated local users to gain administrative control of critical server…. A patch is available.

How to fix or mitigate CVE-2026-46461?

24 hours: Identify all systems running Dell Server Hardware Manager versions prior to 3.2.2; restrict local user account access and new account provisioning. 7 days: Implement monitoring for privilege escalation attempts; enable comprehensive audit logging with alerting. 30 days: Upgrade all affected systems to Dell Server Hardware Manager 3.2.2 or later when available; conduct full access audit and user privilege review.

Dell Server Hardware Manager CVE-2026-46461

EUVD-2026-37997 HIGH

Improper Access Control (CWE-284)

2026-06-19 dell

GHSA-qrpg-jxh9-4948

Authentication Bypass Dell Server Hardware Manager

7.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local agent interface reachable only with an existing low-privileged account (AV:L, PR:L), no user interaction, and successful EoP yields full SYSTEM/root control giving high C/I/A.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 19, 2026 - 11:31 EUVD

Analysis Generated

Jun 19, 2026 - 08:31 vuln.today

DescriptionCVE.org

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Local privilege escalation in Dell Server Hardware Manager versions prior to 3.2.2 allows a low-privileged local user to gain higher privileges due to improper access control (CWE-284). The CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) reflects high impact across confidentiality, integrity, and availability once exploited. No public exploit identified at time of analysis and the CVE is not in CISA KEV.

Technical ContextAI

Dell Server Hardware Manager (cpe:2.3:a:dell:server_hardware_manager) is Dell's agent software for monitoring and managing server hardware components on supported PowerEdge and related platforms. The root cause is classified as CWE-284 (Improper Access Control), meaning a security-relevant resource - likely a service endpoint, IPC channel, file/registry ACL, or privileged operation exposed by the management agent - does not adequately restrict which local principals may invoke it. Because the agent typically runs with elevated rights to perform hardware-level operations, weak access enforcement between a low-privileged caller and the privileged worker is the classic path to local elevation of privilege.

RemediationAI

Vendor-released patch: Dell Server Hardware Manager 3.2.2 - upgrade all installations to version 3.2.2 or later per Dell advisory DSA-2026-243 (https://www.dell.com/support/kbdoc/en-us/000478484/dsa-2026-243-security-update-for-dell-server-hardware-manager-vulnerability). Until the upgrade can be deployed, restrict interactive and remote-shell access to systems running the agent so that only trusted administrators have local accounts (this reduces the pool of principals who satisfy the PR:L precondition, at the cost of operational friction for support staff); audit local group membership and remove unnecessary standard users from hosts running Server Hardware Manager; and where feasible, stop or disable the Server Hardware Manager service on systems that do not actively require hardware monitoring (trade-off: loss of inventory, fault, and thermal telemetry from those hosts). No specific port-block or feature-disable workaround is published by Dell, so the upgrade is the only confirmed fix.