Dell OpenManage Enterprise: hard-coded cryptographic key exposes protected data to a local user

CVSS 7.3CVE-2026-91912Firmware, BMC & network fabriccurated

Impact

OpenManage Enterprise uses a hard-coded cryptographic key, so a low-privileged local user can decrypt data the console protects with it. Dell scores this with a changed scope and high confidentiality impact, which fits data that belongs to other components or to the managed estate rather than to the attacker. On a management console that holds iDRAC and BMC credentials for the fleet, disclosure of protected secrets is the step before out-of-band access to servers. A key baked into the product is also identical across installations, so what one operator can extract applies elsewhere. Dell does not say which data the key protects.

Who can reach it

Local access to the OME appliance with a low-privileged account. Authentication required.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467) - appliance update and console restart. Dell's note does not state whether upgrading rotates anything, so treat credentials the console stored (iDRAC and other device accounts) as potentially exposed and rotate them after the upgrade if local access to the appliance was broader than your admin team.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-91912 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.