Dell OpenManage Enterprise: authenticated low-privilege OS command injection on the management appliance

Impact

A low-privileged remote user of the OpenManage Enterprise console can get commands executed by the appliance. OME is the console that drives iDRAC across a fleet: it holds BMC credentials, pushes firmware and BIOS payloads, and can power-cycle or reconfigure servers. Command execution there is a foothold on the out-of-band management path for every server the appliance manages, which on a GPU estate means the hosts an operator cannot cheaply drain. Dell's record states command execution and does not further detail the reachable command surface.

Who can reach it

Remote network access to the OpenManage Enterprise web interface with a low-privileged console account. Authentication is required, but no administrator role is.

What to do

Upgrade the appliance to OpenManage Enterprise 4.7.0 or later per DSA-2026-359; this is an appliance update and restart, not a host or GPU node outage. Keep the OME interface off general tenant networks and restricted to the management VLAN, and review console accounts - low-privileged ones are the precondition here. Rotate any iDRAC or service credentials the appliance stores if you suspect the console was reached.

References