Dell OpenManage Enterprise: local low-privileged user escalates privileges on the console appliance

CVSS 7.8CVE-2026-101213Firmware, BMC & network fabriccurated

Impact

A user with local access to the OpenManage Enterprise appliance can escalate privileges. Full privilege on the console means access to the stored iDRAC/BMC credentials and to the firmware and power-control workflows for every managed server. The practical exposure depends on who already has a local shell or local session on the appliance, which is usually a small set of infrastructure staff - this is a post-access escalation, not an entry point. Dell's record does not say which component mismanages privileges.

Who can reach it

Local access to the OME appliance with a low-privileged account. Authentication required; no remote path per Dell's vector.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467). Appliance update and console restart; managed nodes are unaffected. Meanwhile restrict and audit local/shell access to the appliance.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101213 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.