Dell OpenManage Enterprise: authenticated SQL injection exposes management database contents

Impact

A low-privileged remote console user can inject SQL and read data from the OpenManage Enterprise database. That database is the inventory and operational record of the managed estate - hosts, service tags, firmware baselines, group membership and console user records. Disclosure hands an attacker a precise map of the fleet's management plane and of which servers are behind on firmware. Dell scopes the outcome to information exposure; the record does not claim write or command execution for this issue.

Who can reach it

Remote network access to the OpenManage Enterprise interface with a low-privileged console account. Authentication is required.

What to do

Upgrade the appliance to OpenManage Enterprise 4.7.0 or later per DSA-2026-359 - the same update that carries CVE-2026-54795, so take both in one window. Appliance update and restart only; no host downtime. Keep the console confined to the management VLAN and prune unnecessary low-privileged accounts.

References