Database/Firmware, BMC & network fabric
Dell OpenManage Enterprise: low-privileged remote user gets OS command execution on the console
Impact
An authenticated user with only low privileges on the OpenManage Enterprise console can run operating-system commands on the appliance. OME is the fleet management plane for Dell server hardware: it holds iDRAC credentials, drives firmware baselines and can power-cycle or re-provision every server it manages, so command execution there is effectively control of the out-of-band path to the whole fleet, including GPU nodes. Dell assigned two ids to this same low-privileged remote OS command injection with identical descriptions and identical scores (CVE-2026-91913, CVE-2026-111505) and fixed both in the same release; this entry covers the pair. Dell's record does not name the affected endpoint.
Who can reach it
Network access to the OpenManage Enterprise console (normally the management VLAN) with any valid low-privileged account. Authentication is required; no user interaction.
What to do
Upgrade OpenManage Enterprise to 4.8.0 per DSA-2026-467. This is an appliance update and restart of the management console - GPU nodes are not drained or rebooted, but the fleet loses monitoring and firmware-update capability during the upgrade window. Until then, keep the console off any routable network and review low-privileged accounts on it.
Also covers 1 CVE
The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.
References
Related entries
- InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsNCVD-2021-006-infiniband-subnet-management-sub · InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsHigh
- InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsNCVD-2021-012-infiniband-subnet-management-sub · InfiniBand subnet management - Subnet Management Packets (SMPs), P_Key/Q_Key partition enforcement, port/node GUIDsHigh
- InfiniBand/RoCE local RNIC - kernel bypass path shared by all local processes: NeVerMore showed that an unprivilegedNCVD-2022-001-infiniband-roce-local-rnic-kerne · InfiniBand/RoCE local RNIC - kernel bypass path shared by all local processesHigh
- AMD Secure Processor - TEE parameter handling: A privileged attacker can hand an arbitrary memory value to functionsCVE-2023-20514 · AMD Secure Processor - TEE parameter handlingHigh
- UEFI firmware SMM modules in Intel reference platform firmware (SMM handler, FlashUcAcmSmm, ImcErrorHandler, WheaERSTCVE-2025-20105 · UEFI firmware SMM modules in Intel reference platform firmwareHigh
- Arista CVX: authenticated Redis session escalates to root on every server in the CVX clusterCVE-2025-5088 · Arista CloudVision eXchange (CVX) Redis serviceHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.