Dell OpenManage Enterprise EUVD-2026-113900

Requires the attacker to be on the adjacent network (AV:A) - the same logical network segment/subnet as the Dell OpenManage Enterprise management console, not arbitrary internet-based remote access - which is the primary limiting factor. No authentication is required (PR:N) and no user interaction is needed (UI:N). Affected deployments are OpenManage Enterprise versions prior to 4.8.0; updating to 4.8.0 removes the condition. The exact configuration or authentication endpoint exhibiting the missing attempt restriction is not detailed in the available sources.

This is a moderate-severity issue (CVSS 5.4) that does not rise to an urgent, widespread-exploitation priority. The vendor-supplied CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates an unauthenticated attacker limited to the adjacent network, with low confidentiality and low integrity impact and no availability impact - consistent with a CWE-307 missing-rate-limit/lockout weakness rather than direct code execution or full data compromise. There is no CISA KEV listing, no EPSS score provided, and no public exploit or PoC reference in the supplied data, so exploitation is neither confirmed nor demonstrated. The vuln.today decision label is 'this_month', signalling scheduled remediation rather than emergency action, which aligns with the signals. One tension worth noting: the description states the impact is 'Launch of phishing attacks' and the tag set includes 'Information Disclosure', yet the CWE is improper restriction of excessive authentication attempts - the precise mechanism by which unthrottled auth attempts enable phishing is not described in the available sources, so the stated impact should be verified against the Dell advisory.

An attacker positioned on the same adjacent network segment as a Dell OpenManage Enterprise console reaches an authentication endpoint that does not properly limit repeated attempts, and without needing credentials or user interaction (AV:A/PR:N/UI:N) abuses that weakness. Per the vendor description this can be leveraged to launch phishing attacks against the product's users. No public exploit identified at time of analysis.