Dell OpenManage Enterprise: improper resource locking lets a local admin bypass a protection mechanism

CVSS 4.7CVE-2026-111498Firmware, BMC & network fabriccurated

Impact

A resource on the OME appliance is not locked correctly, and a high-privileged local account can exploit the race to bypass a protection mechanism, with integrity loss and a high availability impact (4.7). The practical worry for an operator is the availability half: losing the OME appliance means losing fleet inventory, firmware orchestration and BMC-mediated power control until it is restored, which is painful during an incident even though no GPU node is directly affected. Because it requires an already high-privileged local account and a race window, this is the least urgent of the four flaws Dell fixed in this release.

Who can reach it

A high-privileged user with local access to the OME appliance; the advisory marks attack complexity as high, so the race must be won.

What to do

Upgrade the OME appliance to 4.8.0 per Dell DSA-2026-467 - roll it in with the other three fixes from the same advisory rather than scheduling its own window. Appliance services restart; managed GPU nodes need no drain or reboot.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111498 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.