Dell OpenManage Enterprise CVE-2026-91917

Exploitation requires (1) network adjacency to the OpenManage Enterprise console - AV:A means the attacker must be on the same logical/physical adjacent network (e.g., the server management VLAN or an adjacent host), not the open internet - and (2) a pre-existing low-privileged authenticated session or account on the product (PR:L). No user interaction is needed (UI:N). The exact feature, endpoint, or input field that is improperly validated is not described in the available sources. Limiting factors that reduce real-world risk: the adjacent-network requirement (management interfaces are typically segmented), the need for valid low-level credentials, and the availability of a fixed release (4.8.0 and later). It affects OpenManage Enterprise versions prior to 4.8.0.

This is a credible, above-average priority issue but not a drop-everything emergency, which aligns with the vuln.today 'this_week' decision label. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N) describes an adjacent-network attack requiring low privileges (PR:L) and low complexity, with full high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) under an unchanged scope, yielding 8.0 (High). The adjacent-network constraint (AV:A rather than AV:N) and the requirement for some existing low-level authentication meaningfully reduce the exposed attack surface compared with a remote unauthenticated RCE. No EPSS score, CISA KEV listing, or public exploit reference is present in the supplied data, so there is no 'no public exploit identified at time of analysis' and no evidence of active exploitation - the elevated concern rests on the vulnerability class (improper input validation leading to code execution on a management console) rather than on observed in-the-wild activity. A vendor patch (Dell DSA-2026-467) is available, which is the primary risk reducer. Net: treat as a prompt-but-scheduled remediation consistent with 'this_week', not an act_now/emergency item.

An attacker who already holds a low-privileged account and sits on a network segment adjacent to the OpenManage Enterprise console (e.g., a management VLAN or compromised neighboring host) submits crafted, improperly validated input to the application. Because input validation is insufficient (CWE-20), this results in code execution on the management appliance. No public exploit code or PoC reference is present in the supplied data.