Dell OpenManage Enterprise: OS command injection allows command execution
Summary
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability (CWE-78). An attacker with low privileges and remote network access could potentially execute commands on the management server. The CNA rates the issue with CVSS 3.1 8.8 (High); NVD analysis was still pending at the time of writing.
Affected
- Dell OpenManage Enterprise versions prior to 4.8.0 (per CNA record)
Fixed in
- Upgrade to Dell OpenManage Enterprise 4.8.0 or later
- Exact build numbers and interim patches for older branches: Unknown.
Workaround
Unknown. No workaround is listed in the sources reviewed. Check Dell advisory DSA-2026-467 for interim guidance.
Exploitation
- Not known to be exploited.
- No public exploit code indexed as of 30 Oct 2026.
- Not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Identify all OpenManage Enterprise instances and their versions.
- Upgrade to 4.8.0 or later, following Dell advisory DSA-2026-467.
- Confirm the console is not reachable from the internet and is restricted to admin networks.
- Review and remove unused or shared low-privileged accounts.
- Review logs for unusual activity on the console, especially if it has been exposed.
- Re-check exploitation status in the coming weeks, as evidence is still thin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-467 Security Update www.dell.com
- OffSeq Radar: CVE-2026-111505 radar.offseq.com
- OffSeq Radar: Dell OpenManage Enterprise prior to 4.8.0 radar.offseq.com
- Strix: CVE-2026-111505 www.strix.ai
- CVE Threat Intelligence: CVE-2026-111505 cve.threatint.com
- VulDB entry 429038 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:44.
Original description (NVD)
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.