CVE-2026-81475: Dell OpenManage Server Administrator RCE

CVE-2026-81475 Overview

CVE-2026-81475 is a missing authentication for critical function vulnerability [CWE-306] in Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3. An unauthenticated attacker with network access to the OMSA service can potentially exploit the flaw to achieve remote code execution on the affected server. Dell has published advisory DSA-2026-403 and released a fixed build to address the issue.

Critical Impact

Successful exploitation gives an unauthenticated remote attacker code execution on a system used to manage Dell PowerEdge server hardware, exposing the underlying operating system and out-of-band management functions.

Affected Products

• Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3
• Systems running OMSA with the web/remote management interface exposed on the network
• Dell PowerEdge servers where OMSA is deployed for hardware and platform monitoring

Discovery Timeline

• 2026-09-17 - CVE-2026-81475 published to the National Vulnerability Database (NVD)
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-81475

Vulnerability Analysis

Dell OpenManage Server Administrator provides a management interface for monitoring and configuring Dell PowerEdge hardware, firmware, and operating system components. The vulnerability allows a remote attacker to reach a critical function without presenting valid credentials. Because OMSA runs with high privileges to interact with hardware and platform services, a successful exploit chain leads to remote code execution in that privileged context.

The attack requires no user interaction and no prior authentication. Dell's advisory classifies the impact as high across confidentiality, integrity, and availability, consistent with an attacker executing arbitrary commands on the host. Attack complexity is elevated, which suggests the exploit path depends on specific request timing, configuration, or protocol conditions rather than a single trivial request.

Root Cause

The root cause is a missing authentication check on a security-sensitive function exposed by OMSA [CWE-306]. Code paths that should require an authenticated management session are reachable directly over the network. This design gap lets attackers invoke privileged operations that were intended only for authorized administrators.

Attack Vector

Exploitation occurs over the network against an OMSA instance that is reachable by the attacker. The attacker sends crafted requests to the vulnerable endpoint, bypasses the missing authentication check, and reaches functionality that ultimately allows command or code execution. No local access, credentials, or user interaction are required.

No public proof-of-concept exploit code has been published for this issue. Refer to the Dell Security Advisory DSA-2026-403 for vendor-supplied technical details.

Detection Methods for CVE-2026-81475

Indicators of Compromise

• Unexpected child processes spawned by OMSA service binaries or the OMSA web server on Windows and Linux hosts
• Unauthenticated HTTP/HTTPS requests to OMSA management ports (typically TCP 1311) from untrusted networks
• New administrative accounts, scheduled tasks, or services created on servers running OMSA without a corresponding change record
• Outbound connections from OMSA hosts to unknown external IP addresses shortly after inbound management traffic

Detection Strategies

• Inventory all hosts running Dell OpenManage Server Administrator and confirm the installed version against 11.1.0.3.
• Alert on process-execution chains where OMSA components launch shells, script interpreters, or cmd.exe/powershell.exe.
• Baseline normal OMSA management traffic and flag requests from source addresses outside the administration subnet.
• Correlate authentication logs with OMSA access logs to identify successful actions without a preceding authenticated session.

Monitoring Recommendations

• Forward OMSA access, error, and service logs into a central log platform for retention and correlation.
• Monitor TCP port 1311 and any other configured OMSA ports for scanning activity and anomalous request patterns.
• Track firmware, BIOS, and platform configuration changes initiated through OMSA and validate them against approved change tickets.

How to Mitigate CVE-2026-81475

Immediate Actions Required

• Upgrade Dell OpenManage Server Administrator to version 11.1.0.3 or later on all affected servers.
• Restrict network access to OMSA management ports so only dedicated administrative networks and jump hosts can reach them.
• Audit OMSA-managed servers for signs of compromise, including new accounts, unexpected services, and modified platform settings.
• Rotate credentials and secrets stored on or accessible from any server suspected of exposure prior to patching.

Patch Information

Dell has released a fixed build of OpenManage Server Administrator that remediates CVE-2026-81475. Administrators should apply the update documented in Dell Security Advisory DSA-2026-403 and validate that the installed OMSA build is 11.1.0.3 or later.

Workarounds

• Block inbound access to OMSA ports (default TCP 1311) at perimeter and host-based firewalls where the service is not required externally.
• Bind the OMSA management interface to internal management VLANs only, and require VPN or bastion access for administrators.
• Disable the OMSA remote management interface on hosts that do not require remote configuration until patching is complete.

# Example: restrict OMSA management port to an internal admin subnet (Linux, firewalld)
sudo firewall-cmd --permanent --zone=drop --add-port=1311/tcp
sudo firewall-cmd --permanent --zone=internal --add-source=10.10.20.0/24
sudo firewall-cmd --permanent --zone=internal --add-port=1311/tcp
sudo firewall-cmd --reload