Dell OpenManage Enterprise CVE-2026-70422

Exploitation requires the attacker to hold a valid low-privileged account on the Dell OpenManage Enterprise platform (consistent with PR:L in the CVSS vector) and have network access to the web management interface. No special non-default configuration is documented as a prerequisite - any unpatched installation prior to version 4.7.0 with remote access enabled is in scope. Key limiting factors are: the requirement for at least low-privileged credentials (reducing exposure from fully unauthenticated remote exploitation), and SSVC's 'not automatable' classification, which suggests mass-scale automated exploitation without credential access is unlikely. Exploitation is constrained to the network perimeter of the OME interface; air-gapped or firewall-isolated management networks materially reduce real-world risk.

The CVSS 8.8 base score with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H characterizes this as a high-severity, network-exploitable flaw requiring only low-privilege credentials and no special conditions. The full C:H/I:H/A:H triad reflects that successful SQL injection with script-injection capability can yield database exfiltration, data manipulation, and service disruption. However, several signals moderate immediate urgency: EPSS at 0.29% (21st percentile) indicates the vulnerability is currently below the threshold of widespread exploitation activity; SSVC labels exploitation as 'none' at time of reporting; and SSVC marks the flaw as 'not automatable,' a notable tension with the CVSS AC:L rating that likely reflects the need for valid credentials reducing the viability of mass scanning campaigns. The technical impact rating of 'total' in SSVC is consistent with the CVSS impact metrics. No KEV listing and no public POC are confirmed, making this a high-priority patch target for organizations running the affected platform, but not yet an active-exploitation emergency. The primary risk driver is the low privilege barrier - any account holder on the platform could potentially leverage this flaw.

An attacker with a low-privileged account on Dell OpenManage Enterprise crafts HTTP requests to a vulnerable endpoint, embedding SQL metacharacters in user-controlled input fields. The injected payload manipulates the underlying SQL query to enable script injection - potentially invoking server-side command execution facilities exposed via the database layer. No public proof-of-concept exploit code is known at time of analysis.