EUVD-2026-81429
GHSA-vvw4-xc99-99vp
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-reachable but needs valid low-priv credentials (PR:L), a specific triggering condition (AC:H), and operator interaction (UI:R); impact limited to low confidentiality and integrity, no availability.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
4DescriptionCVE.org
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
AnalysisAI
An incorrect authorization flaw in Dell OpenManage Server Administrator (OMSA) affects managed node installations prior to version 11.1.0.3, allowing a low-privileged, authenticated remote user to bypass an intended protection mechanism and gain limited unauthorized read and modification of data on the managed node. Exploitation is significantly gated: per the CVSS vector (AV:N/AC:H/PR:L/UI:R) the attacker must already hold a valid low-privilege OMSA account, a non-trivial timing or configuration condition must be satisfied (AC:H), and a legitimate operator must be induced to perform an action (UI:R), which is why the overall score is only 3.7 and severity is low. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to already hold a valid low-privilege authenticated account with remote/network access to a Dell OMSA managed node instance (PR:L, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-priority, low-severity issue by every available signal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Dell OpenManage Server Administrator to version 11.1.0.3 or later on every managed node, using the platform-appropriate managed node package (Windows, RHEL 8.10, RHEL 9.4, SLES 15, or Ubuntu 22.04) referenced in Dell advisory DSA-2026-403 (https://www.dell.com/support/kbdoc/en-us/000506586/dsa-2026-403-security-update-for-dell-openmanage-server-administrator-omsa-network-access-vulnerabilitiesv). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution is possible against Dell OpenManage Server Administrator (OMSA) managed nodes runn
Improper authentication in Dell OpenManage Server Administrator (OMSA) Managed Node before version 11.1.0.2 allows a rem
Privilege escalation and information tampering in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allow
Unauthenticated remote compromise of Dell OpenManage Server Administrator (OMSA) managed-node installations running vers
Unauthenticated remote OS command injection in Dell OpenManage Server Administrator (OMSA) managed-node builds prior to
A heap-based buffer overflow in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 allows an authent
Unauthenticated path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 lets a remote a
Server-side request forgery in Dell OpenManage Server Administrator versions prior to 11.1.0.3 lets remote, unauthentica
Information disclosure in Dell OpenManage Server Administrator versions prior to 11.1.0.3 allows a locally authenticated
Hard-coded credentials in Dell OpenManage Server Administrator (OMSA) managed-node builds prior to 11.1.0.3 let an unaut
Elevation of privilege in Dell OpenManage Server Administrator (OMSA) managed nodes running versions prior to 11.1.0.3 l
Remote code execution in Dell OpenManage Server Administrator (OMSA) managed-node installations prior to 11.1.0.3: a hea
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today