CVE-2026-81438 is a low severity (CVSS 3.7) flaw in Dell OpenManage Server Administrator versions before 11.1.0.3. The product uses a broken or risky cryptographic algorithm, and an unauthenticated remote attacker could potentially cause information disclosure. Update to 11.1.0.3 or later and confirm details in Dell advisory DSA-2026-403.
What's affected
- Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3, per the CVE record.
- Fixed in 11.1.0.3 or later. We could not retrieve the Dell advisory page when preparing this post, so the versions here come from the CVE record. Confirm them against the Dell advisory before you act.
- The record says an unauthenticated attacker with remote access could potentially exploit it, but the attack complexity in the vector is high.
Record severity: CVSS 3.7 (low), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness class is CWE-327, Use of a Broken or Risky Cryptographic Algorithm.
How to check if you're exposed
On a managed server, read the OMSA version in the web interface, or in the command line with the omreport utility if installed (omreport about). Compare with 11.1.0.3. For many servers, use your configuration management or Dell tooling to list OMSA versions.
What to do now
- Inventory servers with OMSA installed.
- Read each OMSA version.
- Update to 11.1.0.3 or later following DSA-2026-403.
- Restrict the OMSA web port to administration networks.
- Record the update in your change log.
Why it matters
Use of a broken or risky cryptographic algorithm (CWE-327) means the protection looks fine but can be defeated with enough effort or known weaknesses. The score is low because the CVSS vector sets attack complexity to high and the impact to limited confidentiality loss.
Low scores still belong in a normal patch cycle when the fix is a routine update, and the fix here is a point release. The record does not mark the CVE as exploited in the wild.
Quick check
Is this urgent?
The score is low, so fold it into the next planned update, while keeping the OMSA port off untrusted networks.
Which version fixes it?
11.1.0.3 or later, per the record. Confirm with Dell.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
