Dell OpenManage Enterprise CVE-2026-91914

Exploitation requires adjacent-network access (AV:A) - the attacker must be on the same local/management network segment or otherwise L2/L3-adjacent to the OpenManage Enterprise console, not reaching it across the open internet; this is the primary limiting factor. Within that position no authentication is required (PR:N) and no user interaction is needed (UI:N), and the flaw affects Dell OpenManage Enterprise versions prior to 4.8.0. The available sources describe the condition only as an Authentication Bypass by Spoofing leading to session theft; the exact protocol, feature, or configuration that is spoofed is not described in the available sources. The effective mitigation per the vendor is updating to version 4.8.0 or later.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, base 7.1) is the strongest signal available and indicates a low-complexity, unauthenticated attack that does not require user interaction but is bounded to an adjacent network (AV:A) rather than the open internet - so an attacker needs a foothold on the same logical network segment, L2/L3 adjacency, or management LAN as the OpenManage Enterprise console. The high integrity impact (I:H) reflects that authentication-bypass-by-spoofing (CWE-290) lets an attacker steal or forge a session and act as a legitimate user, while confidentiality is only partially affected (C:L) and availability is untouched (A:N). vuln.today assigns a 'this_week' priority (not act_now/emergency), which is consistent with a serious-but-not-drop-everything issue. Key corroborating signals are MISSING: no EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The adjacent-network constraint is the main factor separating this from a wormable internet-facing bug; it is a real priority for organizations whose management network is reachable by lower-trust hosts, but lower urgency where the OME console is strictly isolated.

An attacker who has already gained a position on the same management or adjacent network segment as the Dell OpenManage Enterprise console spoofs or manipulates the authentication exchange to bypass login, resulting in theft of a valid user session. With that session the attacker can impersonate a legitimate OME user and interact with the managed-server fleet. No public exploit code or PoC reference was provided in the available sources.