Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Dell OpenManage Server Administrator allows remote code execution

CVE-2026-80355 · published 1 month ago
Summary

Versions of Dell OpenManage Server Administrator before 11.1.0.3 let anyone on the network trick the software into running commands. This could let an outsider take control of the management console and the servers it manages. Update to version 11.1.0.3 or later on all affected Windows and Linux installations.

What to do
  • Update dell openmanage server administrator managed node (patch) for windows to version 11.1.0.3 or later.
  • Update dell openmanage server administrator managed node for rhel 8.10 to version 11.1.0.3 or later.
  • Update dell openmanage server administrator managed node for rhel 9.4 to version 11.1.0.3 or later.
  • Update dell openmanage server administrator managed node for sles 15 to version 11.1.0.3 or later.
  • Update dell openmanage server administrator managed node for ubuntu 22.04 to version 11.1.0.3 or later.
Affected software
VendorProductAffected versions
dell openmanage server administrator managed node (patch) for windows < 11.1.0.3
dell openmanage server administrator managed node for rhel 8.10 < 11.1.0.3
dell openmanage server administrator managed node for rhel 9.4 < 11.1.0.3
dell openmanage server administrator managed node for sles 15 < 11.1.0.3
dell openmanage server administrator managed node for ubuntu 22.04 < 11.1.0.3
Original advisory text
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploi...
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published17 Sep 2026
Updated29 Oct 2026
First seen17 Sep 2026
Sources
CVE-2026-80355 · NVD
CVE-2026-80355 · MITRE
Track software like this
Free during beta