OpenManage Server Administrator CVE-2026-81480

Exploitation requires the attacker to already hold high privileges (PR:H) on Dell OpenManage Server Administrator and network reachability to the OMSA service; the target must be running a version prior to 11.1.0.3. There is no user-interaction requirement (UI:N) and attack complexity is low (AC:L) once privileged access is held. The high-privilege prerequisite is the primary limiting factor - this cannot be triggered by an unauthenticated or low-privileged remote attacker, so realistic risk is confined to compromised admin accounts, malicious insiders, or chaining from a prior privilege-granting flaw in the same advisory bundle.

Vendor CVSS 3.1 base is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - the PR:H (high privilege) requirement is the single most important risk-reducing signal, because it means an attacker must already hold administrative/high-privilege access before this stack-based buffer overflow can be triggered for code execution. This is not an unauthenticated-RCE emergency despite the network attack vector and full C:H/I:H/A:H impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation. SSVC-style reading: exploitation status = none observed; technical impact = total (code execution); automatable = likely No, since it requires pre-existing high privilege rather than a scannable unauthenticated entry point. Net: this is a defense-in-depth patch priority (a privileged attacker or compromised admin account could escalate to full code execution on the management agent), not a drop-everything internet-facing crisis. This CVE is one of a large DSA-2026-403 bundle and is a near-twin of the heap-based overflow CVE-2026-81477 (identical CVSS/vector); the more urgent items in the same advisory are the unauthenticated PR:N flaws (e.g. CVE-2026-81475 missing authentication for critical function).

A high-privileged attacker with remote access to the OMSA management interface (for example, an administrator whose credentials were phished, or an insider) sends a crafted oversized input to a vulnerable OMSA function, overflowing a stack buffer and overwriting the return address to execute arbitrary code in the context of the OMSA service on the managed Dell PowerEdge host. No public exploit code was identified at time of analysis, and the PR:H requirement means the attacker must first obtain privileged OMSA access.