CVE-2026-91907 in OpenManage Enterprise
Summary
by MITRE • 11/02/2026
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The identified security flaw resides within Dell OpenManage Enterprise software versions preceding 4.8.0 and is classified as an Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting or XSS. This category of vulnerability falls under the CWE-79 standard in the Common Weakness Enumeration taxonomy, which specifically addresses cases where web applications include untrusted data in a way that could be interpreted as executable code by a browser. In this specific instance, the application fails to adequately sanitize user-supplied input before rendering it within dynamic web pages generated by the server-side logic of the management console.
The technical mechanism behind this vulnerability involves the direct inclusion of unsanitized parameters into HTML output without proper encoding or escaping mechanisms. When an unauthenticated attacker with remote network access submits malicious script payloads through vulnerable input fields, query strings, or HTTP headers, these scripts are stored within the application's database or processed in real-time and subsequently reflected back to other users' browsers when they interact with affected pages. Because the browser interprets the injected content as legitimate JavaScript rather than plain text, it executes the code within the security context of the Dell OpenManage Enterprise domain. This bypasses standard same-origin policies that typically restrict scripts from interacting with documents loaded from different origins, thereby allowing the malicious script to access sensitive data and perform actions on behalf of the victim user.
The operational impact of this vulnerability is significant due to its unauthenticated nature, which lowers the barrier for exploitation considerably compared to authenticated XSS flaws. An attacker does not need valid credentials or prior authentication tokens to initiate an attack sequence against users who are logged into the management console. The primary consequence described as information tampering suggests that attackers can modify data displayed within the interface, potentially altering system configurations, device statuses, or alert messages presented to administrators. Beyond simple visual manipulation, such vulnerabilities often enable session hijacking through cookie theft, keylogging of administrative credentials entered on the page, and redirection to phishing sites designed to capture further sensitive information. This compromises the integrity and confidentiality of the IT infrastructure managed by Dell OpenManage Enterprise, potentially leading to broader system compromise if combined with other attack vectors.
Mitigation strategies must prioritize immediate software updates as the most effective remediation path. Administrators should upgrade Dell OpenManage Enterprise to version 4.8.0 or later where these input validation and output encoding issues have been addressed by the vendor through rigorous code review and security patching. In environments where immediate upgrading is not feasible, network-level controls such as Web Application Firewalls can be configured to detect and block common XSS payload patterns in HTTP requests directed at the vulnerable application endpoints. Additionally, implementing strict Content Security Policy headers can mitigate the impact of successful exploitation by restricting the sources from which scripts are allowed to execute, thereby preventing injected malicious code from running even if it is successfully inserted into the page DOM. Regular security audits and penetration testing focused on input validation practices should also be conducted to ensure that similar weaknesses do not exist in other components of the management suite.