Dell OpenManage Enterprise CVE-2026-91907

Exploitation targets the Dell OpenManage Enterprise web console (versions prior to 4.8.0) and requires victim interaction (UI:R): a user - in practice an authenticated OME operator/administrator viewing the affected web page - must load or click attacker-supplied content for the injected script to execute. The attacker themselves needs no credentials (PR:N) and only remote network reachability to the console. Limiting factors that reduce real-world risk: the dependency on a privileged user's interaction, the high attack complexity (AC:H) indicating non-trivial or not-fully-attacker-controlled trigger conditions, and the fact that the specific feature, parameter, or page that reflects the unneutralized input is not described in the available sources. Upgrading to version 4.8.0 is the remediation named by the Dell advisory.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, base 6.8) describes a network-reachable, unauthenticated (PR:N) cross-site scripting flaw, but two signals pull the real-world risk down: AC:H indicates the attacker does not fully control the conditions needed to trigger it, and UI:R requires a victim - in practice an authenticated OpenManage Enterprise operator/admin - to interact (click a crafted link or load attacker-influenced content). The vuln.today decision label is 'this_month', consistent with a serious-but-not-drop-everything priority. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or probable widespread exploitation; exploitation status is 'no public exploit identified at time of analysis'. One signal is internally inconsistent and should be verified with the vendor: the description states only 'Information tampering' (an integrity effect), yet Dell's vector asserts C:H/I:H - the high confidentiality rating is not explained by the description, which typically for XSS would reflect session/token theft in the victim's browser rather than a direct server-side data read. No SSVC decision-point data (automatable, technical impact) was provided. Net: a genuine, patch-worthy flaw whose practical exploitation hinges on social-engineering a privileged user, which materially limits mass exploitation.

An attacker crafts a malicious URL or input that, when processed by Dell OpenManage Enterprise's web interface, injects script that executes in the browser of an authenticated administrator who is lured into clicking it. Because success requires both the specific (undescribed) trigger conditions (AC:H) and victim interaction (UI:R), the attacker most likely relies on phishing or a watering-hole link aimed at console operators. No public exploit code or PoC reference was provided in the source data.