Dell OpenManage Enterprise: missing authentication on a critical function allows adjacent-network SSRF

CVSS 5.4CVE-2026-111500Firmware, BMC & network fabriccurated

Impact

OpenManage Enterprise is the console that inventories, configures and firmware-updates a Dell server fleet, so it sits on the management VLAN with credentials for every iDRAC it manages. An attacker on that adjacent network reaches a critical function with no authentication at all and makes the appliance issue requests of their choosing. That turns OME into a request proxy into the management network - the one segment that normally has no other reachable client - and lets an unauthenticated party probe or poke BMCs, switch management interfaces and other appliances that would otherwise be unreachable from outside it. Dell rates the direct effect as limited integrity and availability loss (5.4), not data theft, so the practical risk is reconnaissance and pivoting rather than immediate fleet takeover.

Who can reach it

Anyone with a foothold on the management VLAN or an adjacent segment that can reach the OME appliance. No authentication and no user interaction required.

What to do

Upgrade the OpenManage Enterprise appliance to 4.8.0 per Dell DSA-2026-467; the upgrade restarts the appliance's services, so the fleet loses its management console for the duration but GPU nodes keep running and need no drain or reboot. Dell's advisory names no workaround; until the upgrade, keep OME reachable only from an administrative jump host rather than the whole management VLAN.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-111500 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.