Dell OpenManage Enterprise CVE-2026-91913

Exploitation requires the attacker to already possess valid low-privileged credentials on the Dell OpenManage Enterprise console (PR:L), reachable over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, API endpoint, or input field that passes unsanitized data to the OS command is not described in the available sources, so the exact trigger cannot be named. The primary limiting factor is the authentication requirement - anonymous unauthenticated exploitation is not indicated - which confines realistic risk to environments where an attacker can obtain or has been granted a low-privilege account. All versions prior to 4.8.0 are affected; upgrading to 4.8.0 is the vendor-stated remediation.

This is a credible near-term priority rather than a theoretical high-CVSS issue, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a remotely reachable, low-complexity flaw requiring only low-level authentication and no user interaction, yielding full confidentiality, integrity and availability impact (C:H/I:H/A:H) - consistent with OS command injection (CWE-78) that lets an authenticated user escape to arbitrary command execution on the appliance host. The vuln.today decision label is 'this_week', aligning with the vendor-reported, high-severity profile. However, key corroborating signals are MISSING: no EPSS exploitation probability was provided, the CVE is not listed in CISA KEV (no active exploitation confirmed), and no public PoC or exploit reference is present in the input. The single limiting factor on real-world risk is the PR:L requirement - an attacker must first hold a valid low-privileged account on the management console, so this is most dangerous as a privilege-escalation/lateral-movement step for an attacker who already has footholds or valid credentials, rather than as a fully anonymous internet attack. Because OpenManage Enterprise manages server infrastructure, successful exploitation has outsized downstream impact.

An attacker with a low-privileged account on a Dell OpenManage Enterprise console (versions prior to 4.8.0) submits input through an affected function that is passed to an OS command without proper neutralization, injecting attacker-controlled command elements. Because the vector is network-based with low attack complexity and no user interaction, the attacker executes arbitrary OS commands on the management host, gaining control over a system that administers server infrastructure. No public exploit code was identified at time of analysis.