CVE-2026-91913 reports OS command injection in Dell OpenManage Enterprise

Summary

A CVE entry reported via TheHackerWire, with a CVSS score of 8.8, describes an OS command injection flaw in Dell OpenManage Enterprise versions before 4.8.0. According to the item, a low-privileged attacker with remote access could potentially exploit it.

If you use Dell

Upgrade Dell OpenManage Enterprise to version 4.8.0 or later

Restrict remote access to the OpenManage Enterprise console

Review accounts with low-privileged access to the console

Upgrade OpenManage Enterprise to version 4.8.0 or later

Limit local and administrative access to OpenManage Enterprise hosts

Review administrator accounts for unexpected activity

What the sources say 12

Oct 30, 2026, 2:31 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.” Source

Oct 30, 2026, 3:01 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability.” Source

Oct 30, 2026, 3:01 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.” Source

Oct 30, 2026, 3:01 PM UTC · Mastodon: “OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability.” Source

Oct 30, 2026, 3:02 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.” Source

Oct 30, 2026, 3:02 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability.” Source

Oct 30, 2026, 3:02 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability.” Source

Oct 30, 2026, 3:02 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability.” Source

Oct 30, 2026, 4:06 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability.” Source

Oct 30, 2026, 4:06 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability.” Source

Oct 30, 2026, 4:06 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability.” Source

Oct 30, 2026, 4:06 PM UTC · Mastodon: “Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability.” Source