Dell OpenManage Enterprise CVE-2026-91905

Exploitation requires the attacker to already hold high-privilege (administrative/PR:H) local access on the Dell OpenManage Enterprise host and to overcome high attack complexity (AC:H), per the CVSS vector; no user interaction is needed (UI:N). The flaw lies in improper verification of a cryptographic signature (CWE-347; tagged as a JWT-related signature attack), so the trigger plausibly involves presenting content whose signature is not properly validated - however, the exact triggering mechanism and the specific feature or token involved are not described in the available sources. Limiting factors that reduce realistic risk: the need for pre-existing local administrative privileges, the local-only attack vector (no remote/network exploitation), and the high complexity. Fixed in OpenManage Enterprise 4.8.0; per the Dell advisory, upgrading is the remediation.

This is a moderate-severity, low-urgency issue whose signals are internally consistent and point away from mass-exploitation concern. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U) describes a vulnerability that requires local access, high attack complexity, and high (administrative) privileges already on the OpenManage Enterprise host - three independent barriers that sharply constrain real-world exploitability. There is no KEV listing, so there is no confirmed active exploitation, and no public exploit was identified at time of analysis; EPSS was not provided in the input, so exploitation probability cannot be quantified here. The vendor-assigned priority is 'this_month' rather than act_now/emergency, consistent with the high prerequisites. The one tension worth noting: impact is rated C:H/I:H/A:H (full confidentiality, integrity, and availability loss) while the description only explicitly states 'Filesystem access for attacker' - the high I and A ratings are inferred by the vendor from that filesystem access rather than described in text. Bottom line: this is a defense-in-depth fix for an attacker who is already a privileged local operator, not a high-real-risk remote threat.

An attacker who has already obtained high-privilege local access to a Dell OpenManage Enterprise appliance abuses the improper cryptographic signature verification (CWE-347) to get access to the filesystem beyond what the signed/verified path should allow. Because exploitation requires existing administrative privileges, local access, and overcoming high attack complexity, the realistic actor is a malicious or compromised privileged insider rather than an external adversary. No public exploit code was identified at time of analysis.