Dell OpenManage Enterprise: improper signature verification allows code execution by an admin

CVSS 6.8CVE-2026-91908Firmware, BMC & network fabriccurated

Impact

OpenManage Enterprise does not properly verify a cryptographic signature, so content an administrator supplies over the adjacent network can run as code on the appliance. The practical worry is the trust boundary this breaks: OME is the component that decides which firmware and update payloads are authentic before pushing them to managed servers, and an administrator who can get unsigned or tampered content accepted escapes the appliance's own integrity controls. Dell scores confidentiality, integrity and availability all high but requires high privilege, so treat this as defence-in-depth loss rather than an entry point.

Who can reach it

Adjacent-network access to the OME console with an administrator-level account. Authentication required.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and console restart, no managed-node action. No interim workaround is published.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91908 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.