EUVD-2026-62439
GHSA-7p5p-8qph-hfqx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
AV:N and PR:L align with remote low-privileged access; I:L rather than I:N reflects typical SQL injection write capability not fully excluded by available data.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
AnalysisAI
SQL injection in Dell OpenManage Enterprise versions prior to 4.7.0 enables low-privileged remote attackers to extract sensitive data from the underlying database and trigger a denial-of-service condition, with a secondary script injection effect that may allow persistent malicious content delivery through the management interface. The vulnerability is rated CVSS 8.1 (High) by Dell, with network-accessible exploitation requiring only low-privileged credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged account on the Dell OpenManage Enterprise instance, consistent with CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) conveys a meaningful real-world threat: the exploit is network-reachable, requires no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privileged account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged OpenManage Enterprise account - such as a read-only operator or a compromised service account - submits a crafted HTTP request containing SQL metacharacters to a vulnerable endpoint in the management console. The unsanitized input is interpolated into a backend SQL query, allowing the attacker to extract database contents (potentially including credentials or configurations for managed Dell infrastructure) or inject persistent script content into the interface that executes in the browsers of higher-privileged administrators. … |
| Remediation | The primary remediation is to upgrade Dell OpenManage Enterprise to version 4.7.0 or later, as documented in Dell advisory DSA-2026-359 at https://www.dell.com/support/kbdoc/en-us/000500910/dsa-2026-359-security-update-for-dell-openmanage-enterprise-vulnerabilities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell OpenManage Enterprise deployments and identify those running versions prior to 4.7.0; immediately segregate or restrict network access to affected systems, permitting only authenticated administrative users from trusted networks via IP whitelisting or VPN. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openmanage Enterprise
View allDell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical seve
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to ma
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to exe
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code In
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated h
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), t
Server-Side Request Forgery in Dell OpenManage Enterprise versions prior to 4.7.0 allows unauthenticated remote attacker
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authen
Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tool
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today