Dell OpenManage Enterprise EUVD-2026-113942

Exploitation requires the attacker to have adjacent (same logical/broadcast segment or directly connected) network access to a Dell OpenManage Enterprise instance running a version prior to 4.8.0 (AV:A, not routable internet-wide). No authentication is required (PR:N) because a critical function is missing an authentication check (CWE-306), and no user interaction is needed (UI:N). The primary limiting factors are the adjacency requirement - the console must be reachable from the attacker's network position - and that only instances below 4.8.0 are vulnerable; the exact critical function, protocol, and the internal endpoints reachable via the SSRF are not described in the available sources.

This is a moderate-severity, context-limited issue rather than an urgent emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 5.4) describes an unauthenticated flaw with low attack complexity and no user interaction, but it is explicitly ADJACENT network (AV:A), not internet-facing remote - the attacker must already have a foothold on the same logical network segment as the management console. Impact is low-only on integrity and availability with no confidentiality impact (C:N), which is unusual for an SSRF and worth noting: SSRF frequently enables reading internal resources, so the vendor's C:N rating may understate data-exposure potential if the SSRF can reach sensitive internal endpoints - verify scope with Dell. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with the signals. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no evidence of active exploitation or widespread automated attack probability. Net: a real but prioritizable patch item for environments where OpenManage Enterprise is reachable from untrusted adjacent networks, not a drop-everything vulnerability.

An attacker positioned on the same adjacent network segment as a Dell OpenManage Enterprise console (version prior to 4.8.0) sends a crafted request to a critical function that is missing an authentication check, causing the server to issue attacker-controlled requests to internal systems. Because no authentication, privileges, or user interaction are required (PR:N/UI:N), the only meaningful barrier is network adjacency. No public exploit code or PoC reference is identified in the available sources.