Dell OpenManage Enterprise CVE-2026-70423

Exploitation requires a valid low-privileged account on the Dell OpenManage Enterprise console (CVSS PR:L confirmed). The attacker must have network-level access to the management interface and must reach an endpoint that processes attacker-supplied XML - such as import, configuration upload, or XML-consuming API functionality. No additional user interaction from administrators or other users is required. Exploitation is limited to instances running versions prior to 4.7.0. The unchanged scope (S:U) means the CVE itself does not directly compromise adjacent systems, though SSRF payloads can probe internal network services reachable from the management host. Exploitation is constrained by the requirement for a valid account - unauthenticated external attackers cannot exploit this directly.

The CVSS 6.5 Medium score accurately reflects the constrained impact profile - confidentiality only (C:H, I:N, A:N) with unchanged scope (S:U) - but understates the strategic value of data accessible through a management platform like OpenManage Enterprise, which may expose BMC credentials, service account tokens, TLS private keys, or internal network topology. Attack complexity is low (AC:L) with no special conditions beyond holding a valid low-privilege account, making the barrier to exploitation minimal once access is obtained. No EPSS data was provided, and the absence of both CISA KEV status and public POC code suggests no confirmed widespread exploitation. SSVC signals lean toward a deferred or scheduled patch cadence for most organizations rather than emergency response, unless insider threat or shared low-privilege access is a concern. The primary realistic risk scenario is a compromised or malicious low-privilege operator account pivoting to extract sensitive configuration data or probe internal services via SSRF. The S:U scope limits direct lateral movement through the CVE itself, though information harvested (credentials, internal hostnames) enables follow-on attacks.

An attacker with a low-privilege OpenManage Enterprise account - such as a read-only operator or helpdesk user - submits a crafted XML document containing an external entity declaration referencing a local file (e.g., a configuration file containing service credentials) to an API endpoint or import function that processes XML. The server's XML parser resolves the entity, reads the file, and returns its contents inline in the API response or error message. No public POC has been identified, but the technique is identical to well-documented XXE patterns with freely available tooling such as Burp Suite or custom scripts, requiring no exploit development expertise.