Dell Openmanage Server Administrator Managed Node For Rhel 9 4
Monthly
Relative path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.2 enables low-privileged remote attackers to read arbitrary files from the underlying server filesystem. The flaw (CWE-23) affects managed node components across Windows, RHEL 8.10, RHEL 9.4, and SLES 15 deployments, as confirmed by Dell advisory DSA-2026-326. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact in a privileged server management context elevates practical risk beyond the moderate CVSS base score alone.
Improper authentication in Dell OpenManage Server Administrator (OMSA) Managed Node before version 11.1.0.2 allows a remote, unauthenticated attacker to bypass authentication controls and gain unauthorized access to the systems management interface across Windows, RHEL 8.10/9.4, and SLES 15 deployments. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction) with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as none, but the trivial attack path makes prompt patching important.
Relative path traversal in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.2 enables low-privileged remote attackers to read arbitrary files from the underlying server filesystem. The flaw (CWE-23) affects managed node components across Windows, RHEL 8.10, RHEL 9.4, and SLES 15 deployments, as confirmed by Dell advisory DSA-2026-326. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact in a privileged server management context elevates practical risk beyond the moderate CVSS base score alone.
Improper authentication in Dell OpenManage Server Administrator (OMSA) Managed Node before version 11.1.0.2 allows a remote, unauthenticated attacker to bypass authentication controls and gain unauthorized access to the systems management interface across Windows, RHEL 8.10/9.4, and SLES 15 deployments. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction) with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and CISA SSVC lists exploitation as none, but the trivial attack path makes prompt patching important.