Dell OpenManage Enterprise CVE-2026-91912

Requires local access to the Dell OpenManage Enterprise host plus a low-privileged authenticated account (CVSS PR:L, AV:L) - this is not remotely exploitable. The specific prerequisite is a Use of Hard-coded Cryptographic Key weakness (CWE-321): the key is embedded in the application and identical across installations, so any actor who reaches the local system and reads the application can derive it and decrypt data it protects. Limiting factors that reduce real-world risk: the attacker must first gain local presence and authenticate as at least a low-privileged user, and only versions prior to 4.8.0 are affected. No special non-default configuration or user interaction is indicated by the advisory; the available sources do not describe exactly which data the key protects.

This is a moderate-priority local vulnerability rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 7.3) describes a locally-exploitable flaw requiring a pre-existing low-privileged authenticated foothold (PR:L), with low complexity and a scope change driving high confidentiality impact. The vuln.today decision label is 'this_week', consistent with a serious but not drop-everything issue. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or widespread exploitation; the single reference is the Dell vendor advisory (DSA-2026-467), not a proof-of-concept. The local attack vector is the dominant risk-limiting factor: an attacker must already have local, authenticated access to the OpenManage Enterprise host before the hard-coded cryptographic key (CWE-321) becomes useful for decrypting protected data. Treat this as a real but gated issue - patch within the vendor/priority window, but it does not present the remote, unauthenticated exposure that would warrant emergency response.

A low-privileged user who already has local access to a Dell OpenManage Enterprise host extracts the application's hard-coded cryptographic key and uses it to decrypt sensitive data protected by that key, resulting in information disclosure. No public exploit code was identified in the provided data; the only reference is Dell's advisory. Because the vector is local (AV:L) with low complexity (AC:L), exploitation is straightforward once local authenticated access is obtained.