Dell OpenManage Enterprise (permissions on a critical local resource): A critical resource on the OME appliance carries

CVSS 5.5CVE-2026-111499Firmware, BMC & network fabriccurated

Impact

A critical resource on the OME appliance carries permissions that are too loose, so a low-privileged account with local access to the appliance can bypass a protection mechanism and read data it should not see (Dell scores high confidentiality impact, 5.5). The appliance holds the credentials and inventory for the servers it manages, so anything a low-privileged local account can read there is leverage over the management plane. Exposure depends entirely on who has shell or low-privileged local access to the OME appliance - in most datacenters that is a short list, which is why the score stays moderate.

Who can reach it

A low-privileged user with local access to the OpenManage Enterprise appliance. Authentication to the appliance is required; no remote path.

What to do

Upgrade the OME appliance to 4.8.0 per Dell DSA-2026-467 (appliance restart, managed nodes unaffected). Dell publishes no workaround; in the meantime, audit and shrink the set of local accounts on the appliance.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111499 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.