CVE-2026-81475 is a high severity (8.1) missing authentication flaw in Dell OpenManage Server Administrator before 11.1.0.3. An unauthenticated attacker with network access could potentially reach remote execution, though the vector marks attack complexity as high. Dell fixed it in 11.1.0.3. Upgrade and restrict network access.
What's affected
Dell's advisory DSA-2026-403 lists Dell OpenManage Server Administrator (OMSA) versions before 11.1.0.3 as affected. The fixed version is 11.1.0.3. The advisory covers 21 CVEs in one update and rates the overall impact as high.
The affected builds are the Managed Node (Patch) for Windows, and Managed Node for RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04. Dell lists no workarounds.
How to check if you're exposed
Find every server where OMSA is installed. It is often installed by the server provisioning process and then forgotten. Check the OMSA version on each host through the OMSA interface or the installed package list for your operating system, and compare it to 11.1.0.3.
Then check network exposure. The record describes an unauthenticated attacker with network access, so OMSA listeners reachable from outside the management network are the first to fix. The advisory title refers to network access vulnerabilities.
What to do now
- List every host running OMSA, across Windows, RHEL, SLES and Ubuntu.
- Upgrade to 11.1.0.3 or later using the driver pages linked in Dell's advisory DSA-2026-403 for your platform.
- Confirm OMSA is reachable only from your management network, and block it elsewhere until the upgrade is done.
- If you cannot upgrade a host soon, consider whether OMSA needs to be running on it at all.
- Re-scan after the upgrade to confirm the old version is gone.
Why it matters
The weakness is CWE-306, missing authentication for critical function. A critical function is reachable without a login. Dell rates the outcome as remote execution.
The high attack complexity in the vector means the attacker needs conditions beyond their control, which is why the score is 8.1 and not higher. That is not a reason to wait. Server management agents run with deep access to the host, and the same advisory fixes related flaws such as CVE-2026-81476. Not listed in CISA's KEV catalog.
A management agent like OMSA is easy to forget. It is installed during provisioning, runs quietly, and rarely shows up in application inventories. That is why one advisory with 21 CVEs can sit unapplied for months. Ask your server team where OMSA lives, and check whether it was installed on hosts that no longer need it.
The network access wording in Dell's advisory title is worth taking literally. If OMSA listeners are only reachable from a management VLAN, your practical exposure is far lower than the score suggests. If they are reachable from a general user network, treat the upgrade as urgent.
Also remember that the fix is a version bump of the whole product, not a single patch. Plan the upgrade for each supported platform separately, because the advisory lists distinct builds for Windows, RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04. Other operating system releases are not listed, so confirm with Dell what applies to yours.
Quick check
Does high attack complexity make this safe to defer?
It lowers the score, not the stakes. OMSA runs close to the hardware, so patch it with the rest of the update.
Sources
Last reviewed: 19 October 2026.
