Dell OpenManage Enterprise CVE-2026-56088

Exploitation requires valid low-privilege user credentials to Dell OpenManage Enterprise; the CVSS vector PR:L confirms unauthenticated access is insufficient. The attacker must have remote network access to the management console interface. The SSVC 'not automatable' finding indicates the injection point is not trivially scriptable and likely requires knowledge of specific application endpoints or parameters. Key limiting factors: authentication barrier (at minimum a low-privilege account is required), non-automatable exploitation profile (targeted attack, not mass scanning), and no current observed exploitation per SSVC and EPSS data. The flaw does not require any special non-default configuration of OpenManage Enterprise itself - it is present in the standard application for all versions below 4.7.0.

The CVSS base score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects high potential impact accessible from the network by a low-privileged user. However, multiple corroborating signals substantially temper the urgency: the EPSS score of 0.26% at only the 18th percentile indicates minimal observed real-world exploitation activity relative to the broader vulnerability population, and the CISA SSVC assessment independently rates exploitation as 'none,' automatable as 'no,' and technical impact as only 'partial' - a notable divergence from the CVSS high-impact ratings that warrants scrutiny. The non-automatable SSVC finding suggests the specific injection point requires targeted knowledge of application internals rather than scripted mass exploitation. The PR:L authentication requirement further constrains opportunistic attackers who would need valid credentials first. Taken together, this is best characterized as a high-severity vulnerability with low current exploitation pressure - appropriate for prioritized patching within a standard patch cycle rather than emergency response, though organizations with internet-exposed OpenManage consoles should treat it with greater urgency.

An attacker with low-privilege credentials to the Dell OpenManage Enterprise console sends a crafted HTTP request to a vulnerable application endpoint, embedding SQL metacharacters that manipulate the backend database query - for example, exfiltrating credential hashes or device configuration data. If the injected content is stored and later rendered in the management UI, it may execute as script in the browser sessions of other authenticated administrators, extending lateral impact. No public exploit code has been identified at time of analysis, but the CWE-89 attack pattern is well-understood and tooling for SQL injection is widely available.