Dell OpenManage Enterprise: weak signature check gives a local admin filesystem access

CVSS 6.7CVE-2026-91905Firmware, BMC & network fabriccurated

Impact

A high-privileged user with local access to the OpenManage Enterprise appliance can defeat a signature check and gain filesystem access, with confidentiality, integrity and availability all rated high. On an appliance that caches iDRAC credentials and update payloads for the fleet, filesystem access is the step from console administrator to appliance-level secrets. Unlike the adjacent-network signature issue in the same advisory (CVE-2026-91908) this one needs local access and Dell describes the outcome as filesystem access rather than code execution, so it is listed separately.

Who can reach it

Local access to the OME appliance - a shell or console session on the host itself - with a high-privileged account. Authentication required.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and console restart; managed nodes are unaffected. No interim workaround is published; limit who holds local or shell access to the appliance.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91905 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.