CVE-2026-66269

HighCVSS 7.5/10Last modified Oct 6, 2026

Description

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-470

Affected software

Vendor	Product	Versions
Dell	Dell OpenManage Server Administrator Managed Node (Patch) for Windows	< 11.1.0.3
Dell	Dell OpenManage Server Administrator Managed Node for RHEL 8.10	< 11.1.0.3
Dell	Dell OpenManage Server Administrator Managed Node for RHEL 9.4	< 11.1.0.3
Dell	Dell OpenManage Server Administrator Managed Node for SLES 15	< 11.1.0.3
Dell	Dell OpenManage Server Administrator Managed Node for Ubuntu 22.04	< 11.1.0.3

References

https://www.dell.com/support/kbdoc/en-us/000506586/dsa-2026-403-security-update-for-dell-openmanage-server-administrator-omsa-network-access-vulnerabilitiesvVendor Advisory

Timeline

Published: Sep 17, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-66278.2The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Strip CVE-2026-662707.2Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A hi CVE-2026-662717.2Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A hi CVE-2026-662725.3Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unaut CVE-2026-662737.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-662747.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issu CVE-2026-662756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affect CVE-2026-662766.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling CVE-2026-662776.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause exces CVE-2026-662797.2In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resultin CVE-2026-66286.3A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the compon CVE-2026-662816.0In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop)