Dell OpenManage Enterprise CVE-2026-91910

Exploitation requires (1) adjacent network access - the attacker must be positioned on a network logically adjacent to the OpenManage Enterprise console (AV:A), not reachable from the open internet, and (2) an existing low-privilege authenticated account on the product (PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, parameter, or protocol that carries the traversable pathname is not described in the available sources. Limiting factors that reduce real-world risk: the adjacency requirement confines attackers to the local/management network, valid low-level credentials are required, and only confidentiality is affected (no write or denial-of-service impact). All versions prior to 4.8.0 are affected; updating to 4.8.0 is the remediation named by the vendor advisory.

This is a moderate-severity issue (CVSS 5.7) that does not rise to emergency priority. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows the attacker needs adjacent network access (AV:A - not internet-routable) and existing low-level privileges (PR:L - authenticated), which materially limits the exploitable population compared to a remote-unauthenticated flaw; the only serious consequence is confidentiality (C:H), with no integrity or availability impact. There is no KEV listing, so exploitation status is 'no public exploit identified at time of analysis', and no EPSS score or POC reference was supplied, so widespread or automated exploitation cannot be inferred. The vuln.today decision label is 'this_month', consistent with a patch-this-cycle rather than drop-everything posture. The signals are internally consistent - a medium CVSS with adjacency and authentication requirements and no evidence of active exploitation all point to a genuine but non-urgent info-disclosure bug. Missing data: no EPSS, no confirmed POC, and the Dell advisory text was not retrieved, so affected-version and fix details rest on the NVD/vendor description ('prior to 4.8.0') alone.

An attacker who already holds a low-privilege account on an adjacent network segment (for example, a user on the same management LAN as the Dell OpenManage Enterprise console) sends a request containing a crafted path-traversal sequence to read files outside the intended restricted directory, exposing sensitive information. No user interaction is required (UI:N) and the attack is low-complexity (AC:L), but the adjacency and authentication prerequisites prevent opportunistic internet-wide exploitation. No public exploit code has been identified at the time of analysis.