Summary
CVE-2026-81478 is a high-severity Use of Hard-coded Cryptographic Key vulnerability (CWE-321) affecting Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3. Because the affected builds rely on a static, embedded cryptographic key rather than one generated or provisioned per deployment, a remote, unauthenticated attacker who obtains or derives this key can potentially gain unauthorized access to systems running the vulnerable software. Dell has rated the issue 8.1 (High) and released version 11.1.0.3 to remediate it.
Technical details
- Root cause: The affected OMSA components use a hard-coded cryptographic key baked into the software rather than a unique, securely generated secret, meaning the same key value is shared across all deployments of the vulnerable version.
- Trigger conditions: No authentication or user interaction is required to attempt exploitation; an attacker only needs network reachability to a vulnerable OMSA instance.
- Attack vector: Network (AV:N) — exploitation can be attempted remotely over the network, though the CVSS vector indicates high attack complexity (AC:H).
- Impact: Successful exploitation can lead to unauthorized system access, with the CVSS impact metrics indicating high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) of the affected node.
Affected software
- Dell OpenManage Server Administrator (OMSA) — all versions prior to 11.1.0.3
- OpenManage Server Administrator Managed Node (Windows Patch) — prior to 11.1.0.3
- OpenManage Server Administrator Managed Node (RHEL 8.10) — prior to 11.1.0.3
- OpenManage Server Administrator Managed Node (RHEL 9.4) — prior to 11.1.0.3
- OpenManage Server Administrator Managed Node (SLES 15) — prior to 11.1.0.3
- OpenManage Server Administrator Managed Node (Ubuntu 22.04) — prior to 11.1.0.3
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade all affected OpenManage Server Administrator Managed Node installations (Windows, RHEL 8.10, RHEL 9.4, SLES 15, Ubuntu 22.04) to version 11.1.0.3 or later, as published in Dell Security Advisory DSA-2026-403.
- If immediate patching is not possible: Restrict network access to OMSA management interfaces to trusted management networks only (e.g., via firewall rules or network segmentation), and avoid exposing OMSA services directly to untrusted or public networks until the update can be applied.
- Review systems for any signs of unauthorized access predating the patch, given the vulnerability could have permitted unauthenticated access to affected nodes.