Dell OpenManage Enterprise CVE-2026-91909

Exploitation requires (1) adjacent-network access per CVSS AV:A - the attacker must reach the OpenManage Enterprise console from the same logical network segment / management network, not the open internet; and (2) a low-privileged authenticated account on OME (PR:L). No user interaction is required (UI:N). The specific product feature, parameter, or command path that accepts the injected argument delimiters is not described in the available sources. These prerequisites - network adjacency plus valid low-privilege credentials - materially limit realistic exploitation to actors already inside the management network with an account.

This is a moderate-severity issue (Dell CVSS 4.6) that signals do NOT elevate to urgent priority. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) constrains exploitation to an adjacent-network attacker who already holds a low-privileged authenticated account, with only partial confidentiality and integrity impact and no availability impact - consistent with the CWE-88 argument-injection class where an attacker influences command arguments rather than achieving clean arbitrary code execution. No EPSS score, KEV listing, or POC is present in the supplied data, so there is no public evidence of exploitation or exploit tooling. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with the modest CVSS and absent exploitation signals. Signals are therefore consistent rather than conflicting: a legitimately lower-risk, defense-in-depth fix rather than a drop-everything emergency. The main caveat is that the advisory text summarizes but does not detail the exact injectable command path, so the real-world impact ceiling of the 'command execution' outcome cannot be fully verified from the available data.

An attacker who already holds a low-privileged account on the OpenManage Enterprise console and has adjacent-network access (same L2 segment / management network) submits input containing crafted argument delimiters that get passed into a system command, causing injected arguments to execute. No public exploit code or POC is identified in the available data, and the specific injectable parameter is not described in the supplied advisory reference.