CVE-2026-54794 — Dell OpenManage Enterprise SSRF Vulnerability

Threat Intelligence Report

Executive Summary

CVE-2026-54794 is a Server-Side Request Forgery (SSRF) vulnerability affecting Dell OpenManage Enterprise versions prior to 4.7.0. An unauthenticated attacker with network access to the management console can exploit this flaw to make the server issue arbitrary HTTP requests, leading to information exposure of internal resources, services, and metadata that should not be accessible from the external network. With a CVSS score of 7.2 (High) and a network-accessible attack vector requiring no credentials, this vulnerability represents a significant risk to organizations relying on Dell OpenManage Enterprise for infrastructure management, though the EPSS score of 0.00200 indicates limited current exploitation activity in the wild.

This vulnerability is classified under CWE-918 (Server-Side Request Forgery) and impacts the confidentiality and integrity of the affected systems. The scope change (S:C) in the CVSS vector indicates that the impact extends beyond the vulnerable component, potentially affecting internal networks and services. Organizations running Dell OpenManage Enterprise below version 4.7.0 should prioritize upgrading to remediate this issue, as the vulnerability is remotely exploitable without authentication.

Technical Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) flaw present in Dell OpenManage Enterprise versions prior to 4.7.0. SSRF is a web security vulnerability class in which an attacker can induce the server-side application to make HTTP requests to arbitrary domains or internal IP addresses of the attacker's choosing. In the context of a management platform like Dell OpenManage Enterprise, this is particularly dangerous because the server typically resides on a trusted network segment with broad access to internal infrastructure components.

The NVD description indicates that the vulnerability affects the application's handling of URLs or network requests submitted by remote clients. The flaw is exploitable by an unauthenticated attacker with remote access, meaning no credentials or session tokens are required to trigger the vulnerable functionality. This significantly lowers the barrier to exploitation and broadens the potential attacker pool to anyone who can reach the OpenManage Enterprise web interface over the network.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N provides the following characteristic details:

• Attack Vector: Network (AV:N) — The vulnerable component is remotely accessible over the network.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are required for exploitation.
• Privileges Required: None (PR:N) — The attacker does not need any authentication credentials.
• User Interaction: None (UI:N) — No victim interaction is required to trigger the flaw.
• Scope: Changed (S:C) — The impact extends beyond the vulnerable component, potentially affecting other resources on the internal network.
• Confidentiality Impact: Low (C:L) — Limited information disclosure is possible.
• Integrity Impact: Low (I:L) — Limited ability to modify data or system state.
• Availability Impact: None (A:N) — No direct denial-of-service impact.

The server-side nature of the vulnerability means the OME server will perform the request using its own network privileges and IP address. This allows the attacker to bypass network segmentation controls, firewalls, and access control lists that would otherwise prevent direct external access to internal resources. The information exposure aspect indicates that response content from the SSRF request may be reflected back to the attacker, enabling data exfiltration from internal services.

Technical detail regarding the specific URL handling endpoints, parameter names, or request formats has not been disclosed in the NVD description. The attack surface is the web-based management interface of OpenManage Enterprise, which listens on standard HTTP/HTTPS ports and is commonly reachable on enterprise management networks.

Exploitation Scenarios

Based on the vulnerability class (SSRF) and the details available in the NVD description, the following attack chain is inferred. No public PoC or exploit code is available; the attack chain is described at the vulnerability-class level.

Step 1: Reconnaissance and Target Identification

An attacker begins by identifying Dell OpenManage Enterprise instances exposed on the network. This can be accomplished through:

• Network scanning for management web interfaces on port 443 or 8443 using fingerprinting techniques.
• Shodan and Censys queries targeting Dell-specific HTTP banners, SSL certificate metadata, or known path structures.
• Google dorking for the web console login page.
• Internal network reconnaissance — from a compromised host inside the network, identifying OME instances via service discovery protocols.

Once an instance is identified, the attacker confirms the version to determine if it falls within the affected range (< 4.7.0) — the version is typically available in the web console footer or via a REST API version endpoint.

Step 2: Triggering the SSRF Flaw

The attacker crafts a malicious HTTP request to the vulnerable functionality within the OpenManage Enterprise web interface. At the vulnerability-class level, this involves:

1. Identifying a feature that accepts a URL, hostname, or IP address as input — such as a proxy configuration, integration endpoint, or diagnostic function.
2. Submitting a URL that points to an internal resource rather than a legitimate external destination.
3. Common SSRF payloads include:
   • http://127.0.0.1/ or http://localhost/ — targeting local services
   • http://169.254.169.254/ — targeting cloud instance metadata services
   • http://<internal-ip>/ — targeting internal servers, databases, or management APIs
   • Alternative representations (decimal IP, IPv6, URL encoding, redirects) to bypass input validation, if any

No authentication is required, so the attacker directly submits the malicious request without needing to establish a session.

Step 3: Payload Execution

The OpenManage Enterprise server processes the request and issues an HTTP request to the attacker-supplied URL from the server's own network context. If the vulnerable functionality reflects the response back to the attacker, the attacker can:

• Read internal HTTP services and their response bodies.
• Probe ports on internal hosts to identify listening services.
• Access cloud metadata endpoints to retrieve IAM credentials, instance identity documents, or configuration data.
• Reach internal APIs that enforce IP-based access controls.

The low confidentiality impact rating suggests that the degree of data returned may be limited, but even partial responses can leak sensitive configuration information.

Step 4: Post-Exploitation Impact

Based on the information gathered through SSRF responses, the attacker can:

• Map the internal network by observing timing differences and response codes from various internal endpoints.
• Access internal web applications that lack their own authentication and rely solely on network-level trust.
• Retrieve cloud instance metadata to obtain temporary credentials for cloud API access (AWS, Azure, GCP).
• Pivot to other systems — information gleaned from internal service responses may reveal credentials, tokens, API keys, or additional attack surface.
• Perform limited integrity actions — the low integrity impact suggests the attacker may be able to send requests that trigger state changes on internal systems, such as creating records or invoking administrative functions.

Important caveat: Without a public PoC or detailed technical documentation, the specific functional module within OpenManage Enterprise that contains the SSRF flaw remains unconfirmed. The attack chain described above follows well-established SSRF exploitation patterns and may not precisely mirror the actual vulnerable code path.

Impact Assessment

Business Impact

Dell OpenManage Enterprise is an enterprise systems management platform used to monitor, configure, and maintain Dell servers, storage, and network devices across data center environments. A successful SSRF exploitation can lead to:

• Confidentiality breach: Exposure of internal network topology, service configurations, and potentially sensitive management data. The CVSS confidentiality subscore of 0.4 (Low) reflects bounded but non-trivial information disclosure.
• Integrity compromise: The low integrity impact indicates partial ability to modify internal data or invoke unintended actions. In a management platform context, this raises concerns about unauthorized changes to device configurations or monitoring settings.
• Regulatory considerations: If internal services exposed via SSRF contain regulated data (e.g., PHI, PII, PCI), the information exposure could trigger compliance breach notification obligations.
• Operational disruption: While the CVSS availability score is None, a compromised management platform undermines trust in infrastructure oversight and may require incident response cycles that cause indirect operational downtime.

Affected Systems

• Dell OpenManage Enterprise versions prior to 4.7.0 are confirmed affected.
• The patch source (NVD) lists the fix as available in version 4.7.0.
• Organizations using Dell OpenManage Enterprise Modular Edition or complementary plugins should verify whether their deployment is within the affected version range, as the NVD entry specifies "Dell OpenManage Enterprise" without sub-product differentiation.

Blast Radius

The CVSS Scope: Changed (S:C) rating is the most concerning element of this vulnerability. It indicates that the security impact extends beyond the OME server itself to the broader internal network. The blast radius includes:

• Internal applications that trust OME's network position.
• Cloud metadata services if OME runs in a cloud environment (AWS, Azure, GCP).
• Adjacent infrastructure management tools (iDRAC, network switches, storage arrays) that may be reachable from the OME server.
• Legacy systems that lack authentication but rely on network isolation for protection.

Exploitation Likelihood

• EPSS score: 0.00200 (10.2th percentile of all scored CVEs) — low probability of exploitation in the wild.
• CISA KEV: Not listed, confirming no known exploitation campaigns reported by CISA.
• PoC/Exploit availability: None confirmed — this reduces immediate tactical risk but does not preclude the development of exploits once technical details become more widely available.
• Patch confidence (2/4): The fix is claimed by a single source (NVD) and has not been independently confirmed. Organizations should verify the availability of version 4.7.0 with Dell support.

Detection Guidance

The following detection rules are provided as a starting point and should be tuned to your environment. Since no public exploit code exists for this vulnerability, these rules target the SSRF behavior class and may produce false positives in environments that legitimately use proxy features or external integrations.

Sigma Rule

title: Dell OpenManage Enterprise SSRF Attempt (CVE-2026-54794)
id: 9f2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential Server-Side Request Forgery attempts against Dell OpenManage Enterprise
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54794
author: Valtersit Threat Intelligence Team
date: 2026/02/15
logsource:
    category: webserver
    product: apache
detection:
    selection_internal_ips:
        cs-uri-query|contains:
            - 'http://127.0.0.1'
            - 'http://localhost'
            - 'http://169.254.169.254'
            - 'http://10.'
            - 'http://172.16.'
            - 'http://172.17.'
            - 'http://172.18.'
            - 'http://172.19.'
            - 'http://172.20.'
            - 'http://172.21.'
            - 'http://172.22.'
            - 'http://172.23.'
            - 'http://172.24.'
            - 'http://172.25.'
            - 'http://172.26.'
            - 'http://172.27.'
            - 'http://172.28.'
            - 'http://172.29.'
            - 'http://172.30.'
            - 'http://172.31.'
            - 'http://192.168.'
    selection_uri_encoding:
        cs-uri-query|contains|all:
            - 'url'
            - 'target'
            - 'dest'
            - 'proxy'
    filter_no_auth_required:
        cs-uri-query|contains:
            - 'login'
            - 'auth'
    condition: selection_internal_ips and not filter_no_auth_required
level: medium
falsepositives:
    - Legitimate administrative use of proxy or integration features
tags:
    - attack.t1190
    - cve.2026.54794
    - cwe.918

YARA Rule

rule DELL_OME_SSRF_CVE_2026_54794
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects SSRF exploitation payloads targeting Dell OpenManage Enterprise"
        date = "2026-02-15"
        cve = "CVE-2026-54794"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54794"
        score = 60

    strings:
        $internal_loopback = "127.0.0.1" ascii nocase
        $internal_localhost = "localhost" ascii nocase
        $cloud_metadata = "169.254.169.254" ascii nocase
        $private_10 = "http://10." ascii nocase
        $private_172 = "http://172.16." ascii nocase
        $private_192 = "http://192.168." ascii nocase
        $uri_param = "url=" ascii nocase
        $uri_param2 = "target=" ascii nocase
        $uri_param3 = "dest=" ascii nocase
        $uri_param4 = "redirect=" ascii nocase
        $uri_param5 = "proxy=" ascii nocase

    condition:
        any of ($internal_* or $private_*) and any of ($uri_param*) and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Dell OpenManage Enterprise SSRF Attempt (CVE-2026-54794)"; flow:established,to_server; content:"GET"; http_method; content:"url="; http_uri; nocase; content:"http://"; http_uri; distance:0; content:"127.0.0.1"; http_uri; nocase; distance:0; content:"GET"; http_method; distance:0; content:"url="; http_uri; nocase; content:"169.254.169.254"; http_uri; distance:0; sid:2026547; rev:1; metadata:created_at 2026-02-15, updated_at 2026-02-15, cve CVE-2026-54794, attack_target server, deployment perimeter, signature_severity Major, tag ssrf, tag dell, tag ome; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-54794;)

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Dell OpenManage Enterprise SSRF Private IP Request (CVE-2026-54794)"; flow:established,to_server; content:"url="; http_uri; nocase; content:"http://"; http_uri; distance:0; pcre:"/http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/Ui"; sid:2026548; rev:1; metadata:created_at 2026-02-15, updated_at 2026-02-15, cve CVE-2026-54794, attack_target server, deployment perimeter, signature_severity Major, tag ssrf, tag dell; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-54794;)

Elastic Detection

// Detect potential SSRF attempts against Dell OpenManage Enterprise
// CVE-2026-54794
any where
  // Web server access logs or HTTP traffic
  process.name : ("httpd", "apache2", "nginx", "tomcat") and
  // Look for URL parameters that carry target URLs
  url.query : (
    "*url=http://127.0.0.1*" or
    "*url=http://localhost*" or
    "*url=http://169.254.169.254*" or
    "*url=http://10.*" or
    "*url=http://192.168.*" or
    "*url=http://172.16.*" or
    "*url=http://172.17.*" or
    "*url=http://172.18.*" or
    "*url=http://172.19.*" or
    "*url=http://172.20.*" or
    "*url=http://172.21.*" or
    "*url=http://172.22.*" or
    "*url=http://172.23.*" or
    "*url=http://172.24.*" or
    "*url=http://172.25.*" or
    "*url=http://172.26.*" or
    "*url=http://172.27.*" or
    "*url=http://172.28.*" or
    "*url=http://172.29.*" or
    "*url=http://172.30.*" or
    "*url=http://172.31.*" or
    "*target=http://127.0.0.1*" or
    "*target=http://169.254.169.254*" or
    "*dest=http://127.0.0.1*" or
    "*redirect=http://127.0.0.1*"
  ) and
  // Exclude known benign usage patterns
  not source.ip : (127.0.0.1, "::1") and
  not user.name : "admin"

Splunk SPL Query

index=web OR index=proxy OR index=ids
  (sourcetype="apache:access" OR sourcetype="iis" OR sourcetype="pan:traffic")
  [
    search index=internal_assets sourcetype=network_traffic
    | stats count by dest_ip
    | where dest_ip LIKE "10.%" OR dest_ip LIKE "192.168.%" OR dest_ip LIKE "172.16.%"
      OR dest_ip LIKE "172.17.%" OR dest_ip LIKE "172.18.%" OR dest_ip LIKE "172.19.%"
      OR dest_ip LIKE "172.20.%" OR dest_ip LIKE "172.21.%" OR dest_ip LIKE "172.22.%"
      OR dest_ip LIKE "172.23.%" OR dest_ip LIKE "172.24.%" OR dest_ip LIKE "172.25.%"
      OR dest_ip LIKE "172.26.%" OR dest_ip LIKE "172.27.%" OR dest_ip LIKE "172.28.%"
      OR dest_ip LIKE "172.29.%" OR dest_ip LIKE "172.30.%" OR dest_ip LIKE "172.31.%"
    | rename dest_ip as target
  ]
  OR (uri_query="*url=http://127.0.0.1*" OR uri_query="*url=http://localhost*"
      OR uri_query="*url=http://169.254.169.254*" OR uri_query="*url=http://10.*"
      OR uri_query="*url=http://192.168.*" OR uri_query="*url=http://172.1[6-9].*"
      OR uri_query="*url=http://172.2[0-9].*" OR uri_query="*url=http://172.3[01].*"
      OR uri_query="*target=http://*" OR uri_query="*dest=http://*"
      OR uri_query="*redirect=http://127.0.0.1*")
  | eval cve="CVE-2026-54794"
  | eval threat="SSRF Attempt - Dell OpenManage Enterprise"
  | table _time, src_ip, dest_ip, uri, uri_query, http_method, status, user_agent, cve, threat
  | sort -_time

Wazuh OSSEC Rule

<group name="dell,ome,ssrf,">

  <!-- CVE-2026-54794: Dell OpenManage Enterprise SSRF - Private IP/Internal URL in web request -->
  <rule id="918704" level="12">
    <if_sid>31100</if_sid>
    <regex>http://(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[01]\.)</regex>
    <description>Dell OpenManage Enterprise SSRF attempt detected - internal IP address in URL parameter (CVE-2026-54794)</description>
    <group>ssrf,cve,dell,ome,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- CVE-2026-54794: SSRF via URL parameter in OME web interface -->
  <rule id="918705" level="10">
    <if_sid>31100</if_sid>
    <regex>(\?|&)(url|target|dest|redirect|proxy|uri)=http://</regex>
    <description>Potential SSRF payload submitted to Dell OpenManage Enterprise interface (CVE-2026-54794) - URL parameter contains HTTP target</description>
    <group>ssrf,cve,dell,ome,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <!-- Correlation: Multiple SSRF attempts from same source -->
  <rule id="918706" level="14" frequency="5" timeframe="300">
    <if_matched_sid>2026547</if_matched_sid>
    <description>Multiple SSRF attempts against Dell OpenManage Enterprise from same source - likely exploitation of CVE-2026-54794</description>
    <group>ssrf,cve,dell,ome,correlation,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source — NVD — claims patch; not independently confirmed).

1. Immediate Mitigations (Before Patching)

While awaiting patch verification and deployment, implement the following controls:

• Network-level filtering: Restrict access to the OpenManage Enterprise web interface to trusted administrative networks only. Apply strict firewall rules at the perimeter and segmentation boundaries to block external access to the management console.
• Web Application Firewall (WAF) rules: Deploy WAF rules to block URL parameters containing internal IP addresses, localhost references, or cloud metadata service addresses (169.254.169.254).
• Egress filtering: Implement outbound network controls on the OME server to restrict which destinations it can communicate with. If the OME server should not be making outbound requests to arbitrary internet hosts, block this at the firewall level.
• Monitoring and alerting: Enable detailed web server access logging on the OME instance and stream logs to your SIEM for real-time detection of SSRF patterns.
• Disable unnecessary features: If the OME instance supports integrations or webhooks that are not in active use, disable these features to reduce the attack surface.

2. Patch / Upgrade Steps

1. Verify fix availability: Contact Dell Support or check the Dell support portal to confirm the availability of OpenManage Enterprise version 4.7.0 and obtain the installation package.
2. Review release notes: Before upgrading, review the official release notes for version 4.7.0 to confirm the inclusion of a fix for CVE-2026-54794 and assess any compatibility changes.
3. Backup configuration: Take a full backup of the OpenManage Enterprise configuration, including the virtual appliance and database snapshots, per standard backup procedures.
4. Schedule maintenance window: Plan the upgrade during a maintenance window, as the OME console will be unavailable during the upgrade process.
5. Execute upgrade: Follow Dell's documented upgrade procedure for OpenManage Enterprise. Verify the upgrade completes successfully and that post-upgrade health checks pass.
6. Verify version: Confirm the running version is 4.7.0 or later after the upgrade is complete.
7. Test functionality: Validate that all integration features, monitoring capabilities, and management functions operate correctly post-upgrade.

3. Long-Term Hardening

• Network segmentation: Place OpenManage Enterprise on a dedicated management VLAN with strict access control lists. Do not expose the management console to the internet or user-facing network segments.
• Authentication hardening: While this particular CVE-2026-54794 does not require authentication, hardening authentication for the OME platform overall (multi-factor authentication, strong password policies) reduces the risk of secondary attacks against other weaknesses in the product.
• Least-privilege networking: Review the OME server's outbound network permissions. Restrict egress rules to only what is necessary for the product's legitimate operations.
• Vulnerability management: Subscribe to Dell security advisories and ensure that OpenManage Enterprise is included in your regular vulnerability scanning and patch management cycles.
• Security monitoring: Maintain the detection rules provided in this report and update them as new TTPs for SSRF exploitation emerge.
• Architecture review: Consider whether OpenManage Enterprise needs direct access to the internet at all. If not, place it appropriately in your network architecture to minimize risk exposure.
• Incident response readiness: Add CVE-2026-54794 to your incident response playbooks, including expected indicators of compromise and response actions.

References

1. NVD Entry — CVE-2026-54794: https://nvd.nist.gov/vuln/detail/CVE-2026-54794

   • Official NVD record containing the CVE description, CVSS vector, and CWE classification.

2. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

   • Technique mapping for network-based exploitation of public-facing management interfaces.

3. CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html

   • Detailed weakness description providing technical context for the SSRF vulnerability class.

4. Dell OpenManage Enterprise Documentation: https://www.dell.com/support/kbdoc/en-us/000212130/openmanage-enterprise

   • Dell product documentation page (verify current URL via Dell support portal). Note: No official Dell advisory for CVE-2026-54794 has been independently confirmed at the time of this report.

5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

   • CVE-2026-54794 is not listed in the KEV catalog as of this report's date; monitor this source for updates.

Threat Actor Campaign Notes

As of the publication date of this report, no known threat actor campaigns have been publicly attributed to exploitation of CVE-2026-54794. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no exploit code or PoC has been publicly released. Organizations should nonetheless take this vulnerability seriously given its network-exploitable, unauthenticated nature and the high-value positioning of OpenManage Enterprise within data center environments. Monitoring through the detection rules provided above is recommended to identify early exploitation attempts should attackers develop working exploits.

Report generated by Valtersit Threat Intelligence — February 2026.