Dell OpenManage Enterprise EUVD-2026-113894

Exploitation requires an authenticated, high-privileged account on the Dell OpenManage Enterprise console (CVSS PR:H), which is the primary limiting factor and restricts the attack to privileged insiders or attackers who have already compromised such an account. The interface is reachable over the network (AV:N) with no user interaction (UI:N), and all versions prior to 4.8.0 are affected. The specific product feature, parameter, or command into which argument delimiters are injected is not described in the available sources, so the exact trigger is unverified beyond the CWE-88 argument-injection classification.

This is a moderate-severity, authenticated privilege-escalation issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network reachability and low complexity, but PR:H means the attacker must already hold high privileges on the Dell OpenManage Enterprise console before they can abuse the argument-injection flaw to gain further elevation - a significant barrier that constrains the realistic attacker population to insiders or those who have already compromised a privileged account. The vuln.today decision label is 'this_week', indicating meaningful but not critical urgency. No EPSS score, no CISA KEV listing, and no proof-of-concept were supplied in the input, so exploitation is not confirmed in the wild and no public exploit code is evidenced. There is no conflict between the signals: the CVSS network vector combined with PR:H is internally consistent with a remotely-reachable management plane that still requires prior high-privilege authentication. The main missing data points are EPSS probability and any independent exploitation telemetry, so prioritization rests on the vendor advisory and the CVSS vector alone.

An attacker who already possesses a high-privilege account on the Dell OpenManage Enterprise web console sends a crafted request whose parameters inject additional command-line argument delimiters into a backend command, causing the system to execute with attacker-controlled arguments and elevating the attacker's effective privileges. No user interaction is required and the attack is delivered over the network to the management interface. No public exploit code is evidenced in the available data.