Dell OpenManage Enterprise CVE-2026-70421

Exploitation requires that the attacker already possesses a high-privileged account on the target Dell OpenManage Enterprise instance, consistent with CVSS PR:H - unauthenticated users and low-privileged users cannot exploit this vulnerability. The attack is conducted remotely over the network (AV:N) with no user interaction required (UI:N) and no special attack complexity (AC:L), meaning any network-reachable OME console is a viable target once credentials are in hand. The primary limiting factor is the mandatory high-privilege credential prerequisite; environments enforcing strong credential hygiene, multi-factor authentication on the OME console, and minimal admin account provisioning substantially reduce realistic exploitation risk despite the network-accessible attack vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) scores 7.2, reflecting that while the attack is network-accessible and requires no user interaction or special attack complexity, it mandates high-privileged credentials as a prerequisite - a meaningful constraint that significantly limits the opportunistic attacker pool. The unchanged scope (S:U) confines post-exploitation impact to the OpenManage Enterprise application itself rather than enabling lateral movement into the broader host OS. However, full C:H/I:H/A:H ratings indicate that once exploited, an attacker achieves total compromise of the management plane, which controls Dell server infrastructure. No EPSS score, KEV listing, or public proof-of-concept is available from the provided intelligence, suggesting this is not currently subject to widespread exploitation campaigns. Real-world risk is most acute in environments where OME admin credentials are shared, weakly protected, or exposed to insider threat - scenarios where the PR:H barrier is effectively lowered.

An attacker who obtains valid high-privileged Dell OpenManage Enterprise credentials - through credential stuffing, phishing a server administrator, or insider access - connects remotely to the OME web console and exploits the privilege mismanagement flaw to escalate beyond their existing high-privilege role, gaining unrestricted control over the management platform. With this elevated access, the attacker can reconfigure managed Dell PowerEdge servers, extract sensitive inventory and credential data stored within OME, or disrupt server operations across the managed infrastructure. No public proof-of-concept has been identified at time of analysis.