CVE-2026-91904 in OpenManage Enterprise
Summary
by MITRE • 11/02/2026
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The identified security flaw resides within Dell OpenManage Enterprise software in versions preceding the 4.8.0 release and is classified as an incorrect permission assignment for a critical resource. This category of vulnerability typically arises when an application fails to properly configure access control lists or file system permissions on sensitive files, directories, or configuration settings that are essential for maintaining system integrity and security posture. In this specific instance, the misconfiguration allows entities with lower privilege levels than intended to interact with resources that should be restricted to administrative users only. The core technical failure lies in the absence of robust validation checks during resource initialization or access requests, which results in a breakdown of the principle of least privilege. This oversight creates an environment where standard user accounts can inadvertently or intentionally modify critical system parameters that govern security policies and operational behaviors.
From an operational perspective, this vulnerability enables a low-privileged attacker who has already established local access to bypass existing protection mechanisms. The term Protection mechanism bypass indicates that the flaw undermines safeguards designed to prevent unauthorized changes or data exfiltration. By exploiting incorrect permissions, an attacker can alter configuration files, modify service settings, or manipulate registry entries depending on the underlying operating system architecture of the OpenManage Enterprise appliance. This capability effectively neutralizes security controls such as audit logging restrictions, firewall rules managed by the platform, or authentication configurations. Consequently, the integrity of the management infrastructure is compromised, allowing the attacker to escalate privileges further, disable monitoring tools, or create backdoors that persist across reboots and updates.
The impact extends beyond immediate privilege escalation to include potential denial of service conditions if critical configuration files are corrupted or deleted by unauthorized users. Furthermore, attackers may leverage this access to exfiltrate sensitive management credentials stored in accessible directories, thereby gaining control over connected physical servers and network devices managed by the OpenManage Enterprise platform. This lateral movement capability significantly expands the attack surface from a single virtual appliance to the entire data center infrastructure it oversees. The vulnerability aligns with Common Weakness Enumeration identifier CWE-732 for incorrect permission assignment, which highlights failures in ensuring that only authorized subjects can access specific resources. Additionally, this scenario maps to MITRE ATT&CK technique T1098.004 representing SSH Authorized Key Manipulation if the exploited resource involves authentication keys, or more broadly to privilege escalation vectors where local users abuse misconfigured file permissions to gain higher-level system rights.
To mitigate this risk, organizations must immediately upgrade Dell OpenManage Enterprise to version 4.8.0 or later, as these updates include corrected permission settings that enforce strict access controls on critical resources. Until the patch is applied, administrators should restrict physical and network-based local access to the appliance strictly to trusted personnel with high-level administrative privileges. Implementing robust file integrity monitoring solutions can help detect unauthorized modifications to configuration files associated with OpenManage Enterprise components. Regular audits of system permissions using automated compliance scanning tools are recommended to identify any deviations from secure baseline configurations. Additionally, enforcing multi-factor authentication for all management interfaces and segmenting the management network from general corporate traffic reduces the likelihood of an attacker achieving the initial local access required to exploit this vulnerability.