Dell OpenManage Enterprise EUVD-2026-113944

Exploitation requires local access to a Dell OpenManage Enterprise instance running a version prior to 4.8.0, plus pre-existing low-level privileges on that system (CVSS PR:L); it is not remotely exploitable over the network (AV:L) and needs no user interaction. The concrete misconfigured resource and the specific permission flaw are not enumerated in the available sources, so the exact file/object exposed is unverified. The principal limiting factors are the local-access requirement and the need for the attacker to already hold valid low-privilege credentials, which substantially narrows the realistic attacker population to insiders or an adversary who has already gained a foothold.

This is a moderate-severity, local-access vulnerability that is unlikely to be a top-tier emergency but warrants timely patching. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is internally consistent with the description: an attacker needs local access and already-held low privileges (PR:L), and the only impact is to confidentiality (C:H), with no integrity or availability effect. This aligns with CWE-732 (Incorrect Permission Assignment for Critical Resource) - overly permissive permissions let a low-privileged local user read a protected resource they should not, i.e. a protection-mechanism bypass. The vuln.today decision label is 'this_month' (not act_now/emergency), which matches the risk profile. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no signal of active or probable near-term mass exploitation. The signals do not conflict: a local-only, low-privilege, confidentiality-only flaw with no exploitation evidence is a genuine but non-urgent patch-management item rather than a high-CVSS-but-overrated issue. Note the limiting factor is the local-access precondition - remote mass exploitation is not indicated by the vector.

A low-privileged user who already has local/authenticated access to the Dell OpenManage Enterprise appliance leverages incorrectly assigned permissions on a critical resource to read protected data they should not be able to access, bypassing an intended protection mechanism. No public exploit code or proof-of-concept was identified in the available data. Because the CVSS vector is local with low privileges required (AV:L/PR:L), the attacker must first have a foothold and credentials on the system.