Dell OpenManage Enterprise EUVD-2026-115142

Exploitation requires (1) network adjacency to the OpenManage Enterprise console - i.e., presence on the same LAN or management VLAN, not arbitrary internet reach (AV:A), and (2) valid low-privileged authenticated access to the console (PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The exact feature, field, or protocol that passes attacker input into the OS command is not described in the available sources. The limiting factors - required adjacent positioning plus existing credentials - are the primary constraints defenders should weigh; network segmentation of the management plane and strict least-privilege account control materially reduce exposure. The only confirmed complete fix per Dell's advisory is upgrading to version 4.8.0 or later.

This is a credible mid-tier priority rather than an emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N) describes a low-complexity, no-user-interaction OS command injection that nonetheless requires two real constraints: adjacent-network positioning (AV:A, not full remote AV:N) and existing low-privileged authentication (PR:L). High impact across confidentiality, integrity and availability (C:H/I:H/A:H) is consistent with arbitrary command execution on a management appliance, which justifies the 8.0 base score. The vuln.today decision label is 'this_week', signaling prompt but not immediate action. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were provided - so there is no evidence of active exploitation or weaponization; the risk is currently theoretical and gated by the need for adjacent access plus valid low-level credentials. The flaw was self-reported by Dell, which lends vendor confidence to the affected-version data but tells us nothing about in-the-wild activity. Net: real and worth patching this cycle, but the access and privilege prerequisites meaningfully reduce the likelihood of opportunistic mass exploitation compared to a network-reachable unauthenticated bug.

An attacker who already holds low-privileged credentials on Dell OpenManage Enterprise and sits on an adjacent network segment (same LAN/management VLAN as the console) submits crafted input into a feature that passes unsanitized data to an OS command, achieving command execution on the appliance host. No user interaction is required. No public exploit code or PoC reference was provided in the available sources.