EUVD-2026-54474
GHSA-6cvg-9479-mvfp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Improper authentication is remotely reachable with no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), and unauthorized management access yields total system impact (C:H/I:H/A:H).
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Improper authentication in Dell OpenManage Server Administrator (OMSA) Managed Node before version 11.1.0.2 allows a remote, unauthenticated attacker to bypass authentication controls and gain unauthorized access to the systems management interface across Windows, RHEL 8.10/9.4, and SLES 15 deployments. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction) with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as none, but the trivial attack path makes prompt patching important.
Technical ContextAI
OMSA is Dell's server management agent that exposes a web-based and remote-accessible interface (historically over ports such as 1311) for monitoring and configuring PowerEdge server hardware, firmware, and health. The flaw is classified as CWE-287 (Improper Authentication), meaning the authentication mechanism guarding the OMSA Managed Node component can be circumvented or incorrectly validated rather than a memory-safety or injection defect. The affected component is the 'Managed Node' package (the agent installed on the server being managed), confirmed by CPE strings spanning the Windows patch build and Linux builds for RHEL 8.10, RHEL 9.4, and SLES 15. Because OMSA runs with high privilege to manage underlying hardware, an authentication bypass exposes sensitive management functions to unauthenticated callers.
RemediationAI
Vendor-released patch: upgrade Dell OpenManage Server Administrator Managed Node to version 11.1.0.2 or later on all affected platforms (Windows, RHEL 8.10, RHEL 9.4, SLES 15), following Dell advisory DSA-2026-326 at https://www.dell.com/support/kbdoc/en-us/000494958/dsa-2026-326-security-update-for-dell-openmanage-server-administrator-omsa-network-access-vulnerabilities. Until patching is complete, restrict network access to the OMSA management interface (historically TCP 1311) using host firewalls or network ACLs so it is reachable only from a trusted management network or jump host, which prevents remote unauthenticated reach at the cost of requiring administrators to connect through the permitted management segment. Where OMSA is not actively used, stopping or disabling the OMSA service removes exposure entirely but also disables server health monitoring and remote hardware management via OMSA. Avoid exposing the OMSA interface to the internet or flat corporate networks under any circumstance.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today