Dell OpenManage Enterprise: OS command injection from a low-privileged adjacent account

CVSS 8.0CVE-2026-94349Firmware, BMC & network fabriccurated

Impact

Unsanitized special elements reach an OS command on the OpenManage Enterprise appliance, giving a low-privileged adjacent-network user command execution with the appliance's own privileges. That is the host that stores iDRAC credentials and pushes firmware and power workflows to managed servers, so the blast radius is the managed fleet rather than one console. Dell scores confidentiality, integrity and availability all high. This is a distinct flaw from the argument-injection issue in the same advisory (CVE-2026-91909) and Dell assigned it its own id and CWE class; the affected command path is not identified.

Who can reach it

Adjacent-network access to the OME console plus a valid low-privileged account. Authentication required.

What to do

Upgrade to OpenManage Enterprise 4.8.0 (DSA-2026-467): appliance update and console restart, no managed-node downtime. No workaround is published; restrict console reachability to the management segment and review who holds low-privileged OME accounts.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-94349 https://www.dell.com/support/kbdoc/en-us/000523220/dsa-2026-467-security-update-for-dell-openmanage-enterprise-vulnerabilities

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.