OpenManage Enterprise CVE-2026-54793

The attacker must possess a valid low-privileged account on the Dell OpenManage Enterprise web interface (confirmed by PR:L in the CVSS vector) - unauthenticated exploitation is not possible. A separate victim user must actively interact with the page or view where the injected script is rendered (confirmed by UI:R), meaning the attack cannot be fully automated against a passive target. The OpenManage Enterprise web interface must be network-accessible to the attacker (AV:N). Exploitation is further limited by: (1) the need to obtain even a low-privileged credential, which may require prior phishing or credential theft; (2) the dependency on a victim - typically a higher-privileged user - visiting the poisoned page; and (3) unchanged scope (S:U), meaning the attacker cannot leverage this XSS to escape the web application context into the host OS.

The CVSS 4.6 Medium score is consistent with the constraint set: network-accessible (AV:N), low complexity (AC:L), but requiring a low-privileged account (PR:L) and victim interaction (UI:R). These two limiting factors - authentication and user interaction - meaningfully reduce real-world exploitation probability relative to a fully unauthenticated, no-interaction XSS. No EPSS score was provided in the input data, so probability-based prioritization cannot be applied. The absence of both a CISA KEV listing and any reported POC further supports a non-urgent posture for organizations running patched infrastructure. For environments where OpenManage Enterprise is exposed to internal threat actors (e.g., shared administrative consoles, contractor-accessible networks), the PR:L prerequisite is weaker than it appears, as low-privileged accounts may be widely provisioned. S:U and A:N confirm no privilege escalation or availability impact pathway exists through this vector.

A low-privileged attacker with a valid OpenManage Enterprise account injects a malicious JavaScript payload into a data field - such as a device label, alert annotation, or profile name - that is later rendered in the management console viewed by an administrator. When the administrator navigates to the affected view, the script executes silently in their browser, exfiltrating their session cookie or capturing sensitive infrastructure data to an attacker-controlled endpoint. No public exploit code is known at time of analysis, but the low technical complexity of XSS attacks means skilled attackers could develop one independently.