OpenManage Server Administrator EUVD-2026-81618

Requires a valid low-privileged authenticated session to Dell OpenManage Server Administrator (CVSS PR:L) on versions prior to 11.1.0.3, plus network reachability to the OMSA management interface (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker must already possess or obtain low-privilege OMSA credentials, and OMSA must be installed and its management service network-exposed - deployments that isolate the management interface to a restricted admin network materially reduce exposure. Impact is confidentiality only (arbitrary file read); no write/integrity or availability effect.

This is a genuine but moderate-priority issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) describes a remotely reachable, low-complexity path-traversal that requires an authenticated but only low-privileged account (PR:L), and yields high confidentiality impact with no integrity or availability impact - consistent with arbitrary file READ rather than write or code execution. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation signals are limited to the CVSS characteristics; per precision rules this is 'no public exploit identified at time of analysis.' The main risk driver is that OMSA is a server-management agent frequently exposed on management networks and running with elevated service privileges, so a read primitive can leak sensitive host files (credentials, configs, keys). This is not a drop-everything critical (no RCE, no unauth access, integrity/availability untouched), but the C:H impact plus network reachability and only low-privilege gating make it a solid patch-soon item rather than a low-real-risk high-CVSS artifact. Note the single reference is a Dell KB/DSA advisory page whose content was not directly retrieved here, so fix details rely on the vendor advisory title and the stated 'prior to 11.1.0.3' fixed version.

An attacker who holds any low-privileged OMSA account (or has phished/obtained one) sends a crafted request containing directory-traversal sequences to the OMSA web/management service, escaping the intended restricted directory to read arbitrary files on the underlying server such as configuration files, credentials, or private keys. No user interaction is needed and complexity is low, but a valid low-privilege authenticated session is required. No public exploit code was identified in the provided intelligence.