CVE-2026-70423

Executive Summary

CVE-2026-70423 is an XML External Entity (XXE) injection vulnerability in Dell OpenManage Enterprise affecting all versions prior to 4.7.0. A low-privileged attacker with remote network access can exploit this flaw to read arbitrary files from the underlying server filesystem, resulting in high confidentiality impact. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a low attack complexity and no user interaction required; however, the EPSS score of 0.00277 (20.3rd percentile) indicates limited active exploitation in the wild as of the reporting date. The issue is classified under CWE-611 (Improper Restriction of XML External Entity Reference). Dell OpenManage Enterprise is a systems management console widely deployed in enterprise data centers for firmware, driver, and lifecycle management of PowerEdge servers, making this a significant concern for organizations relying on centralized server administration.

Technical Analysis

Vulnerability Mechanism

The vulnerability is classified under CWE-611: Improper Restriction of XML External Entity Reference — a member of the broader "Improper Input Validation" weakness class. In essence, the affected Dell OpenManage Enterprise application (versions prior to 4.7.0) processes XML input in one or more API endpoints or web services without safely restricting the resolution of external entities.

When an XML parser is configured with external entity resolution enabled (i.e., the parser processes <!DOCTYPE> declarations and <ENTITY> definitions), an attacker can submit XML payloads that instruct the processor to fetch and incorporate external content. The two primary attack primitives in XXE are as follows:

1. File Disclosure — Using an external entity with a file:// URI scheme (e.g., <!ENTITY xxe SYSTEM "file:///etc/shadow">), the parser substitutes the entity reference with the contents of an arbitrary file. The file content is then included in the parser's response or subsequent processing, exposing sensitive server-side data.

2. SSRF (Server-Side Request Forgery) — Using external entities pointing to http:// or https:// URLs (e.g., <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">), the server becomes an open proxy, enabling scanning of internal networks and reaching cloud metadata services.

Given the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the vulnerable parser is remotely accessible without requiring authentication from the network perspective, but the attacker must hold at least low-level application credentials to reach the vulnerable function. The high confidentiality score (C:H) is consistent with arbitrary file read — including files such as configuration files, credential stores, or application secrets — while integrity and availability are unaffected.

Attack Surface

Dell OpenManage Enterprise is a web-based virtual appliance that consolidates the management of Dell PowerEdge servers, providing REST API services, a web UI, and an inventory of all managed devices. The XML-processing functionality exists in one or more of the following surfaces:

• REST API endpoints accepting XML payloads (Content-Type extensions or misuse of Content-Type header).
• The web management GUI where XML files are imported (device profiles, configuration backups, or certificate handling).
• Integration interfaces where XML-based communication with managed nodes or third-party systems occurs.

Important note: The NVD description provides no specific endpoint, API path, parameter name, or file path. The above surfaces are reasonable inferences from the product's known architecture, but the specific entry point is not publicly confirmed. Insufficient technical detail is available to pinpoint the exact code-level location.

Confirmed Details from Description

• Product: Dell OpenManage Enterprise
• Affected versions: Prior to 4.7.0
• Fix version: 4.7.0
• Attack requirement: Low-privileged remote access (authenticated user with low privileges)
• Impact: Information exposure (confidentiality breach)
• Privileges required: Low (PR:L) — the attacker needs an account with minimal privileges on the application
• User interaction required: None (UI:N)
• Attack complexity: Low (AC:L) — no special conditions or race windows required

Exploitation Scenarios

Prerequisites

• Network access to the Dell OpenManage Enterprise management interface (TCP 443 typically, though the NVD description does not specify a port).
• A valid low-privileged user account on the OME appliance (required by the PR:L component of the CVSS vector).

Attack Chain

Step 1: Reconnaissance / Target Identification

An attacker first identifies Dell OpenManage Enterprise instances exposed on a network. This can be done through:

• Network scanning for management web portals (identifiable by HTTP banners, favicon hashes, or distinctive login pages).
• Shodan/Censys queries for Dell OpenManage Enterprise fingerprints.
• Active Directory or inventory harvesting to identify the appliance's IP address.

Once located, the attacker authenticates with a low-privilege account. Common default low-privilege accounts (e.g., a read-only operator role) are a potential entry vector if administrators have not enforced strict password policies or MFA.

Step 2: Triggering the Flaw Class

The attacker identifies the XML-consuming feature. Without public disclosure of the exact endpoint, the exploitation at the vulnerability-class level proceeds as follows:

• The attacker crafts a request to any XML-accepting API endpoint or upload function.
• The request body includes a malicious DOCTYPE declaration with an external entity reference, e.g.:

  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
  <request>&xxe;</request>
  

• The server-side XML parser, lacking proper restriction of external entity resolution, substitutes the &xxe; reference with the content of /etc/passwd (or any target file).
• The returned response (or downstream processing) reflects the file contents.

Step 3: Specific Payload/Execution Method

At the vulnerability-class level, the exploitation variants are:

• File read: file:///etc/passwd, file:///etc/shadow, file:///opt/dell/ome/conf/secrets (path names are illustrative, not confirmed).
• Blind XXE with out-of-band exfiltration: If the application does not reflect file content in the response, the attacker uses an external DTD hosted on an attacker-controlled server to exfiltrate file contents via HTTP requests.
• SSRF: Pointing the entity at internal IP addresses to discover internal infrastructure or reach cloud metadata endpoints.

Step 4: Post-Exploitation Impact

• Credential theft: Access to application configuration files that may contain database credentials, LDAP bind passwords, or API keys.
• Lateral movement: Stolen credentials can enable further access to managed PowerEdge servers (iDRAC credentials are often stored in OME).
• Internal network mapping: SSRF variant enables scanning of the internal network through the compromised appliance as a relay.

Note

No public PoC or exploit code is known for CVE-2026-70423. This attack chain is inferred from the vulnerability class and the NVD description. The specific endpoint or feature that consumes XML is unknown from public reporting.

Impact Assessment

Severity & Score Analysis

• CVSS 3.1 Base Score: 6.5 (Medium) — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Key subcomponents:

  • Attack Vector (AV:N): Network-reachable; no physical or adjacent access required.
  • Attack Complexity (AC:L): Low — no special conditions, race conditions, or mitigation bypass required.
  • Privileges Required (PR:L): Low — attacker needs valid application credentials of any role.
  • User Interaction (UI:N): None.
  • Scope (S:U): Unchanged — the compromised component (OME appliance) and the impacted component are the same security scope.
  • Confidentiality (C:H): High — arbitrary file read could expose critical secrets.
  • Integrity (I:N): None.
  • Availability (A:N): None.

• EPSS Score: 0.00277 (20.3rd percentile) — low probability of exploitation within 30 days; suggests this is not a currently popular target.

• CISA KEV: Not listed — no evidence of active exploitation as a known exploited vulnerability.

Business Impact

Threat Landscape

• Active exploitation: No CISA KEV entry; EPSS at 20th percentile suggests minimal in-the-wild activity.
• Known threat actors: None associated with this CVE.
• Time-to-exploit window: Patch confidence is 2/4 (claimed, single source), meaning the fix (4.7.0) may be the only reliable mitigation; exploit development is likely if the vulnerable XML endpoint is identified and documented.

Detection Guidance

Sigma Rule

title: Dell OpenManage Enterprise XXE Exploitation (CVE-2026-70423)
id: c2959b1d-9f34-4d0b-9e63-3a9c01f0bb2a
status: experimental
description: Detects XML payloads containing DOCTYPE declarations with external entity references sent to Dell OpenManage Enterprise endpoints.
author: Valtersit Threat Intelligence
date: 2026/04/15
logsource:
    category: webserver
    product: dell_openmanage
detection:
    selection_body:
        http.request.body|contains:
            - '<?xml'
            - '<!DOCTYPE'
            - 'SYSTEM'
            - 'file://'
            - 'http://'
            - 'https://'
    selection_response:
        http.response.status_code|startswith: '200'
    condition: selection_body and selection_response
falsepositives:
    - Legitimate XML-based configuration uploads by administrators
    - XML integration traffic with third-party systems
level: high
fields:
    - src_ip
    - dest_ip
    - user_agent
    - http.request.body

YARA Rule

rule CVE_2026_70423_Dell_OME_XXE_Payload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects XXE payload patterns targeting Dell OpenManage Enterprise (CVE-2026-70423)"
        cve = "CVE-2026-70423"
        date = "2026-04-15"
        severity = "high"
    strings:
        $doctype = "<!DOCTYPE" nocase
        $entity = "<!ENTITY" nocase
        $file_scheme = "file://" nocase
        $http_scheme = "http://" nocase
        $system_keyword = "SYSTEM" nocase
        $xml_header = "<?xml" nocase
        $xxe_name = /<!ENTITY[\s]+[a-zA-Z0-9_-]+[\s]+SYSTEM[\s]+["'](file|http|https|ftp|gopher):\/\//
    condition:
        // Document must be XML header with external entities
        $xml_header at 0 and $doctype and $entity and ($file_scheme or $http_scheme) and $system_keyword or $xxe_name
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-70423 Dell OpenManage Enterprise XXE Attempt";
    flow:to_server,established;
    content:"<?xml"; http_client_body; nocase;
    content:"<!DOCTYPE"; http_client_body; distance:0; nocase;
    pcre:"/<\!ENTITY\s+[a-zA-Z0-9_-]+\s+SYSTEM\s+[\"'](?:file|http|https|ftp|gopher):\/\//i";
    sid:5000701;
    rev:1;
    metadata:created_at 2026-04-15, updated_at 2026-04-15, cve CVE-2026-70423;
)

Elastic Detection

// Detect XXE payload in HTTP requests to Dell OpenManage Enterprise
sequence by source.ip
  with maxspan=1m
  [ network where event.category == "network" and
    destination.port in (443, 80) and
    url.path like "*/ome*" ]  // Broad OME path matching; adjust as needed
  [ http where event.category == "http" and
    http.request.method == "POST" and
    // XML body with external entity reference
    (http.request.body.content contains "<!DOCTYPE" and
     http.request.body.content contains "SYSTEM" and
     (http.request.body.content like "file://*" or
      http.request.body.content like "http://*" or
      http.request.body.content like "https://*" or
      contains "ftp://")) ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache OR sourcetype=plain_text
| WHERE http_method="POST"
| WHERE xml_body LIKE "%<!DOCTYPE%" 
    OR xml_body LIKE "%<!ENTITY%" 
    OR xml_body LIKE "%SYSTEM%" 
    OR xml_body LIKE "%file://%" 
    OR xml_body LIKE "%http://%"
| eval is_xxe = if((like(xml_body, "%<!DOCTYPE%") OR like(xml_body, "%<!ENTITY%")) AND (like(xml_body, "%SYSTEM%") OR like(xml_body, "%file://%")), "true", "false")
| WHERE is_xxe = "true"
| stats count by src_ip, dest_ip, uri, http_user_agent, _time
| sort - _time

Wazuh OSSEC Rule

<group name="dell_openmanage,">
  <rule id="100701" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.xml$|ome.*api|/dbbuf|\.html</field>
    <regex>SYSTEM</regex>
    <regex>file://</regex>
    <regex>http://</regex>
    <description>Dell OpenManage Enterprise XXE attempt (CVE-2026-70423) - DOCTYPE with external entity detected</description>
    <group>attack.xxe,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100702" level="12">
    <if_sid>100701</if_sid>
    <regex><\!DOCTYPE</regex>
    <regex><\!ENTITY</regex>
    <description>CVE-2026-70423 - Confirmed XXE payload targeting Dell OpenManage Enterprise</description>
    <group>attack.xxe,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment

Patch Confidence Level: 2/4 (CLAIMED) — The availability of a fix in version 4.7.0 is referenced only by NVD as a single source. This has not been independently confirmed via a vendor advisory (Dell Security Advisory) or multi-source verification. Action: Treat the patch as authoritative but verify with the vendor before relying solely on it.

1) Immediate Mitigations (before patching)

• Restrict access: Limit network access to the OpenManage Enterprise web portal and REST API to trusted management VLANs or jump hosts only. Block direct Internet exposure if present.
• Enforce MFA: Require multi-factor authentication for all OME accounts, especially low-privilege accounts, since the attacker needs a valid account (PR:L).
• Review account hygiene: Disable or remove stale low-privilege accounts. Ensure default credentials are changed.
• WAF/IDS rules: Deploy the Suricata/Wazuh rules above on the perimeter and DMZ to detect XXE attempts in transit.
• Monitor file access: On the OME appliance, monitor and alarm on reads of sensitive files (/etc/passwd, /etc/shadow, application .properties or configuration files) via the host OS auditing tools.

2) Patch/Upgrade Steps

• Primary action: Upgrade all Dell OpenManage Enterprise appliances to version 4.7.0 or later. This version claims to include the fix.
• Verification: Confirm the patch with Dell's official advisory via the Dell Support site (https://www.dell.com/support). The advisory should validate that the XML parser configuration has been hardened to disallow external entity resolution.
• Backup: Perform a full configuration backup before upgrade; OME upgrades that fail can require restore from backup.
• Post-upgrade validation: After upgrade, verify the XML-processing feature no longer resolves external entities by testing with benign entity declarations (e.g., one that references a local harmless file) on a staging instance before production rollout.

3) Long-Term Hardening

• Least privilege: Revoke all low-privilege accounts where read-only access is not strictly required. Restrict XML upload/import features to administrator roles only.
• Network segmentation: Keep OME in a dedicated management network with strict egress firewall rules. Block OME's outbound Internet access to limit SSRF and blind XXE exfiltration channels.
• XML parser hardening: If OME exposes any APIs where custom XML processing is configured, ensure external entity resolution is globally disabled (e.g., via parser setting XMLConstants.ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_SCHEMA for Java).
• Monitor vendor advisories: Subscribing to Dell's security notification feed ensures early awareness of any deviations from the claimed patch.
• Credential rotation: After applying the patch, rotate all stored iDRAC/vCenter/LDAP passwords within OME, as they may have been exposed to attackers who exploited this vulnerability prior to remediation.

References

1. NVD Entry for CVE-2026-70423 — https://nvd.nist.gov/vuln/detail/CVE-2026-70423
2. Dell Support / Security Advisories — https://www.dell.com/support/security (Search for CVE-2026-70423 for the vendor advisory confirming the 4.7.0 fix)
3. CWE-611 Reference — https://cwe.mitre.org/data/definitions/611.html (Improper Restriction of XML External Entity Reference — weakness definition)
4. OWASP XXE Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html (applicable mitigation/parser hardening guidance)
5. EPSS (Exploit Prediction Scoring System) — FIRST — https://www.first.org/epss/ (contextual exploitation likelihood scoring; CVE-2026-70423 scored 0.00277)

Threat Actor Campaigns & In-the-Wild Evidence

• CISA KEV: Not listed; no known exploits reported to CISA.
• Public exploit code: None found at the time of writing.
• In-the-wild exploitation: EPSS 0.00277 (20.3rd percentile) indicates limited to no observed exploitation in the current threat landscape. Organizations should nonetheless prioritize patching given the high confidentiality impact on centrally stored device credentials.

Report generation date: April 15, 2026
Classification: TLP:CLEAR