CVE-2026-91914 in OpenManage Enterprise
Summary
by MITRE • 10/30/2026
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Dell OpenManage Enterprise versions prior to 4.8.0 represents a critical security flaw classified as an authentication bypass through session spoofing or manipulation. This issue stems from insufficient validation mechanisms within the application's web interface and underlying API endpoints, which fail to properly verify the integrity of session tokens or identifiers during transmission. Consequently, an attacker operating on the same local network segment can intercept valid session cookies or manipulate request parameters to impersonate legitimate users without providing valid credentials. The core technical flaw lies in the lack of robust binding between the client IP address and the active session state, combined with potentially weak cryptographic practices for generating or validating session identifiers that allow prediction or replay attacks.
From an operational perspective, this vulnerability poses a severe risk to infrastructure management systems. Dell OpenManage Enterprise serves as a centralized platform for managing servers, storage, and networking devices within enterprise data centers. Unauthorized access via session theft allows attackers to gain administrative privileges over these critical assets. This can lead to the exfiltration of sensitive configuration data, modification of system settings that could disrupt business operations, or the installation of persistent backdoors for further lateral movement within the network. The ability to bypass authentication entirely means that traditional perimeter defenses such as firewalls and intrusion detection systems may not detect this activity if it originates from a trusted internal subnet, making it particularly dangerous in environments where trust boundaries are loosely defined between management networks and production networks.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-384 Session Fixation within the Common Weakness Enumeration framework. In terms of offensive security tactics, this exploit maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically focusing on session hijacking or token manipulation rather than credential theft. The attack vector is classified as adjacent network access, meaning it requires physical proximity or logical connectivity within the same broadcast domain, which limits its remote exploitation potential but increases its likelihood in internal threat scenarios involving compromised endpoints or insider threats.
To mitigate this risk, organizations must immediately apply the vendor-provided patches to upgrade Dell OpenManage Enterprise to version 4.8.0 or later where these authentication checks have been hardened. In addition to patching, network segmentation strategies should be reviewed to ensure that management interfaces are isolated from general user networks using VLANs and strict access control lists. Implementing multi-factor authentication for administrative accounts adds an additional layer of security that can mitigate the impact of session theft even if a token is compromised. Furthermore, enabling secure cookie attributes such as HttpOnly and Secure flags helps prevent client-side script access to session tokens and ensures transmission only over encrypted channels, reducing the surface area for interception-based attacks.