Dell OpenManage Enterprise CVE-2026-91915

Exploitation requires an attacker already authenticated to Dell OpenManage Enterprise with high privileges (PR:H) and positioned on an adjacent network (AV:A) - not a remote, internet-reachable path. The vulnerability affects versions prior to 4.8.0, so running 4.8.0 or later removes exposure. The available sources do not name the specific OpenManage Enterprise feature, field, or downstream component that must be reached to trigger the script injection, so the exact configuration prerequisite beyond privileged adjacent access is not described in the input. The combination of required administrative privilege and adjacency are the primary factors limiting realistic exploitation to insiders or already-compromised management-network actors.

This is a moderate-severity issue (CVSS 6.8) that does not rise to emergency priority. The CVSS vector CVSS:3.1/AV:A/AC:L/PR:H/UI:N requires both adjacent network access (AV:A, not internet-routable) and high privileges (PR:H), two significant barriers that sharply limit the realistic attacker population to those already positioned on the local/adjacent network segment with administrative rights on Dell OpenManage Enterprise. The vuln.today Decision label is 'this_month' rather than act_now or emergency, consistent with the elevated prerequisites. No EPSS score, CISA KEV listing, or public PoC/exploit reference is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The headline C:H/I:H/A:H impact looks severe, but it is gated behind PR:H and AV:A - this is a high-CVSS-reads-worse-than-real-risk situation for internet-exposure concerns, while still meriting timely patching inside trusted management networks because an already-privileged adjacent actor gains script-injection capability. No signals conflict; the chief limitation is sparse corroborating intelligence (single vendor advisory, no independent severity or exploitation telemetry).

An attacker who already holds high-privileged access to a Dell OpenManage Enterprise console and sits on an adjacent network segment submits input containing unneutralized special elements that is passed to a downstream component, resulting in script injection. No public exploit code is identified at time of analysis, so exploitation would require the attacker to develop the injection payload themselves. Because adjacent access and high privileges are both required, the scenario is largely an insider or post-compromise lateral-movement case rather than remote mass exploitation.