Dell OpenManage Enterprise: privileged user can inject OS commands and run code on the appliance

Impact

An attacker who already holds a high-privileged OpenManage Enterprise account can get command execution on the management appliance itself, with full confidentiality, integrity and availability impact. That appliance is the machine that stores iDRAC credentials and pushes firmware and BIOS updates to every managed server, so code execution there is a foothold on the out-of-band control path for the whole fleet rather than a single host. On a GPU estate that is the difference between one compromised admin session and an attacker positioned to push firmware to nodes that cannot be drained cheaply. Dell does not identify the injectable parameter, so there is no partial mitigation to apply at the request layer.

Who can reach it

Remote network access to the console plus an account that already carries high privileges in OpenManage Enterprise. This is a privilege-boundary escape for an existing admin or a stolen admin credential, not an entry point for an anonymous attacker.

What to do

Upgrade the appliance to OpenManage Enterprise 4.7.0 or later per DSA-2026-359; no workaround is published. The upgrade restarts the management appliance, leaving managed servers untouched. Also review who holds high-privilege OME roles and rotate the iDRAC and directory credentials the appliance stores if you have reason to suspect the console was already reachable by an untrusted admin.

References