OpenManage Enterprise CVE-2026-54794

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration - network reachability to the Dell OpenManage Enterprise web interface on any version prior to 4.7.0 is the sole prerequisite. No specific feature flag or non-default configuration setting is required to be vulnerable. Exploitation is limited in practice by network placement: organizations that restrict OpenManage Enterprise access to isolated management VLANs or out-of-band networks are significantly less exposed. The scope change (S:C) further conditions the attacker's ability to reach internal resources on the network topology accessible from the OpenManage host - a host with limited egress will yield less valuable SSRF pivot paths than one with broad internal reachability.

The CVSS 7.2 score is driven by a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N/UI:N) vector with a scope change (S:C) - the scope change is the most significant signal here, confirming that exploitation is not self-contained and can affect internal systems the OpenManage host can reach. The C:L/I:L/A:N impact metrics are conservative but appropriate for SSRF: direct code execution is not possible, but internal network topology exposure and service enumeration are realistic outcomes. No EPSS score was supplied in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, suggesting no confirmed widespread active exploitation at this time. However, SSRF in enterprise server management consoles is a historically attractive target class for lateral movement and credential harvesting, and the unauthenticated network vector with scope change makes this a genuine priority - not a high-CVSS-but-low-real-risk paper finding. Organizations exposing OpenManage Enterprise to untrusted networks should treat patching as urgent regardless of KEV absence.

An unauthenticated attacker with network access to the OpenManage Enterprise web interface submits a crafted HTTP request containing an attacker-controlled URL, causing the server to issue an outbound connection to an internal target - such as the AWS/Azure instance metadata endpoint at 169.254.169.254 or an internal management API. The server's response is returned to the attacker, revealing credentials, internal IP ranges, or configuration data usable for lateral movement deeper into the managed server infrastructure. No public proof-of-concept has been identified at time of analysis.