OpenManage Enterprise CVE-2026-54795

Exploitation requires possession of a valid low-privilege account on the Dell OpenManage Enterprise console - this is confirmed by the CVSS PR:L metric. No special non-default configuration or feature flag appears to be required; the vulnerability is present in the base product for all versions prior to 4.7.0. Remote network access to the OME web interface is required (AV:N). No user interaction from a victim is needed (UI:N). The primary limiting factors for real-world exploitation are: (1) the requirement for at least low-privilege authentication reduces the attack surface to parties who have or can obtain valid credentials; (2) OpenManage Enterprise is typically deployed on internal management networks or behind VPNs in security-mature organizations, limiting direct internet exposure; (3) the specific vulnerable parameter or endpoint has not been publicly disclosed, requiring an attacker to enumerate the application surface. Organizations with internet-exposed OME instances or environments with weak credential hygiene face substantially elevated risk.

The CVSS 8.8 High score is well-supported by the vector metrics: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). The low attack complexity is the most critical risk amplifier - once credentials are obtained, exploitation does not require chaining additional conditions or bypassing mitigations. The PR:L requirement provides real but thin friction; in enterprise environments, service desk accounts, monitoring users, or contractor credentials could satisfy this threshold. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. No CISA KEV listing exists at time of analysis, and no POC has been publicly identified - these are meaningful risk-reducing signals. However, OS command injection in a privileged management console is a high-value target for lateral movement within data center environments, making this a genuine remediation priority for organizations with internet-facing or broadly-accessible OME deployments. SSVC assessment: Exploitation is not confirmed active; technical impact is total; the attack is plausibly automatable once credentials are in hand - suggesting an 'Attend' or 'Act' priority depending on exposure posture.

An attacker who has obtained low-privilege OpenManage Enterprise credentials - through phishing, credential stuffing against the management portal, or reuse of compromised service account passwords - sends a crafted HTTP request to a vulnerable endpoint, embedding shell metacharacters or command sequences in a parameter that is later passed unsanitized to an OS shell call. The injected commands execute on the server with the privileges of the OME application process, potentially granting the attacker a foothold to pivot across the data center management network, exfiltrate server inventory data, or manipulate firmware and configuration. No public POC has been identified at time of analysis, but the low attack complexity suggests a capable attacker could develop working exploitation quickly.