Dell OpenManage Enterprise: argument injection lets a low-privileged adjacent user execute commands

CVSS 8.0CVE-2026-91909Firmware, BMC & network fabriccurated

Impact

A low-privileged console account reaching OpenManage Enterprise from the adjacent network can inject argument delimiters into a command the appliance builds, reaching command execution. OME holds iDRAC credentials and drives firmware updates, boot order and power actions across the managed fleet, so command execution on the appliance converts an ordinary read-mostly console login into hardware-level control of every GPU node it manages. Dell rates confidentiality, integrity and availability all high. The record names the class and not the affected command path.

Who can reach it

Adjacent-network access to the OME console - in practice the management VLAN it sits on - with a valid low-privileged account. Authentication required.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and management-console restart; managed nodes need no action. No interim workaround is published, so keep the console on an isolated management segment in the meantime.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91909 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.