CVE-2026-91909 — Dell Openmanage Enterprise
MEDIUMCVE-2026-91909 is a medium-severity (CVSS 4.6) CWE-88 vulnerability in dell openmanage enterprise. A fix is available — see the affected versions and patch details below.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker…
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-91909.
Description
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.
Affected Products
openmanage enterprisedellDetection & mitigation playbook
Vendor / applianceDetect
Inventory every dell openmanage enterprise deployment and check each version against the affected-products list above.
Fix
Apply the dell openmanage enterprise security patch or hotfix for CVE-2026-91909 on the affected version, following the vendor advisory for your exact build.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-91909 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.