Dell OpenManage Enterprise: XML external entity processing exposes information to a low-privileged user

Impact

OpenManage Enterprise parses XML without restricting external entity references, and Dell characterises the result as information exposure to a remote low-privileged attacker; the advisory does not state what can be read, so do not assume full arbitrary file read. What makes it worth a window is where OME sits: it is the fleet console for iDRACs, holding server inventory, firmware baselines and credentialed access to the out-of-band path of every GPU chassis. Anything an operator-tier account can pull out of that appliance shortens the route to the management network that can power-cycle or reflash nodes. Confidentiality only per the scored vector — no integrity or availability impact claimed.

Who can reach it

A remote attacker holding a low-privileged OpenManage Enterprise account, reaching the OME console over the network. Authentication is required. In a correctly segmented datacenter that means someone already on the management VLAN or with valid OME credentials.

What to do

Update OpenManage Enterprise to 4.7.0 or later per Dell DSA-2026-359. This is an appliance-side update: the OME console is unavailable while it restarts, but managed servers keep running and no GPU node needs to be drained, rebooted or reflashed. Both this and CVE-2026-70424 are fixed by the same release, so do them in one window. Independently, confirm the OME console is not reachable outside the management VLAN and review who holds low-privileged OME accounts.

References