CVE-2026-81476 is a high severity (8.1) OS command injection flaw in Dell OpenManage Server Administrator before 11.1.0.3. An unauthenticated attacker with network access could potentially reach remote execution, with high attack complexity. Dell fixed it in 11.1.0.3, so upgrade and keep OMSA off untrusted networks.
What's affected
Dell's advisory DSA-2026-403 lists Dell OpenManage Server Administrator (OMSA) versions before 11.1.0.3 as affected. The fixed version is 11.1.0.3. The advisory covers 21 CVEs in one update and rates the overall impact as high.
The affected builds are the Managed Node (Patch) for Windows, and Managed Node for RHEL 8.10, RHEL 9.4, SLES 15 and Ubuntu 22.04. Dell lists no workarounds.
How to check if you're exposed
Find every server where OMSA is installed. It is often installed by the server provisioning process and then forgotten. Check the OMSA version on each host through the OMSA interface or the installed package list for your operating system, and compare it to 11.1.0.3.
Then check network exposure. The record describes an unauthenticated attacker with network access, so OMSA listeners reachable from outside the management network are the first to fix. The advisory title refers to network access vulnerabilities.
What to do now
- List every host running OMSA, across Windows, RHEL, SLES and Ubuntu.
- Upgrade to 11.1.0.3 or later using the driver pages linked in Dell's advisory DSA-2026-403 for your platform.
- Confirm OMSA is reachable only from your management network, and block it elsewhere until the upgrade is done.
- If you cannot upgrade a host soon, consider whether OMSA needs to be running on it at all.
- Re-scan after the upgrade to confirm the old version is gone.
Why it matters
The weakness is CWE-78, improper neutralization of special elements used in an OS command. Input reaches a command line without being made safe, so data can change what the command does. Dell does not publish the exact input or endpoint, and this post does not guess.
The record is not flagged in CISA's KEV catalog. The related CVE-2026-81475 and CVE-2026-81478 have the same 8.1 score, and all three are fixed in the same release.
Quick check
What is the one change that fixes this?
Upgrade OMSA to 11.1.0.3 or later. The advisory lists no workaround.
Sources
Last reviewed: 19 October 2026.
