OpenManage Enterprise CVE-2026-71176

Exploitation requires a valid low-privileged authenticated account on the Dell OpenManage Enterprise instance (PR:L per CVSS vector) and remote network access to the OME web management interface over HTTP/HTTPS (AV:N). No additional user interaction by a victim is required (UI:N), and no non-default configuration or specific feature enablement is identified as a prerequisite in available data. The primary limiting factors are: (1) the attacker must hold valid credentials for any low-privileged OME role - unauthenticated exploitation is not indicated by the PR:L CVSS metric; and (2) the OME management console must be network-reachable from the attacker's position, meaning environments that isolate OME to a dedicated management VLAN or block external access significantly reduce the exposed attack surface. Scope is unchanged (S:U), so exploitation impact is bounded to the OME application and its database.

The CVSS 3.1 base score of 8.8 reflects a network-accessible attack vector, low complexity, and low-privilege requirement, making exploitation achievable by any authenticated user without specialized skills or tooling. A notable discrepancy exists between the vendor description, which characterizes impact solely as 'information exposure,' and the CVSS vector, which assigns High ratings across Confidentiality, Integrity, and Availability - security teams should consult the full Dell advisory DSA-2026-359 to confirm whether write and destructive SQL operations have been demonstrated or remain theoretical. No EPSS data was included in the provided intelligence, and this CVE is not listed in the CISA KEV catalog, meaning active exploitation is unconfirmed; however, the low barrier to exploitation means that even a mid-sized municipal IT team in swidnica managing a Dell-heavy environment should treat this as urgent, since low-privileged accounts are routine in enterprise management platforms and the attack requires no special configuration. No public proof-of-concept code has been identified at time of analysis.

An attacker holding a low-privileged Dell OpenManage Enterprise account sends a crafted HTTP request to a vulnerable endpoint - such as a search, filter, or device-query function - embedding SQL metacharacters that alter the backend query logic. The injected SQL allows the attacker to enumerate the management database schema and extract sensitive records, including device credentials, SNMP community strings, user account data, and audit logs. No public proof-of-concept is currently known, but the low attack complexity and well-understood nature of SQL injection make independent exploit development feasible for a moderately skilled attacker.