OpenManage Enterprise CVE-2026-54796

Exploitation requires a high-privileged account on Dell OpenManage Enterprise - confirmed by the CVSS PR:H metric. The attack is delivered over the network (AV:N) without requiring any additional user interaction on the victim side. Exploitation is limited by: (1) the mandatory requirement for high-privilege credentials, meaning an attacker without admin-level access to OpenManage Enterprise cannot trigger the vulnerability directly; (2) unchanged scope (S:U), so direct impact is contained to the OpenManage Enterprise application host unless the attacker pivots further using the OS-level access gained. No special non-default configuration is implied as a prerequisite beyond the privilege requirement - any default deployment exposing the management interface to a network where an attacker holds valid admin credentials is potentially at risk.

The CVSS 7.2 score (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity vulnerability with full C/I/A impact reachable over the network at low complexity. The primary mitigating factor is PR:H: exploitation is gated behind high-privileged credentials, confining realistic risk to scenarios involving compromised admin accounts, insider threats, or multi-step attack chains that first escalate to administrator access. The unchanged scope (S:U) limits direct blast radius to the OpenManage Enterprise host itself, though that host typically has broad privileged access to managed Dell infrastructure, making post-exploitation impact significant in practice. No CISA KEV listing and no known public exploit reduce urgency relative to a comparably-scored vulnerability under active exploitation. EPSS data was not provided in the available intelligence. Overall, this is a genuine high-priority finding for organizations running Dell-heavy environments, but the PR:H requirement means it is not exploitable by unauthenticated remote attackers and does not represent an immediate mass-exploitation risk.

An attacker who has obtained high-privileged administrative credentials - through phishing, credential stuffing, or a prior intrusion - authenticates to the Dell OpenManage Enterprise web interface and submits a crafted request containing OS command metacharacters to a vulnerable input field or API parameter. The backend processes the input and passes it unsanitized to a system shell, executing attacker-specified commands with the privileges of the OpenManage Enterprise service account on the underlying server. No public proof-of-concept has been identified, but the AC:L rating indicates exploitation is straightforward once valid credentials are in hand.