CVE-2026-91907 Dell CVE debrief

Who should care

Defenders responsible for Dell OpenManage Enterprise deployments should assess exposure and potential impact. Defenders should prioritize verifying exposure and assessing potential impact of the Cross-site Scripting vulnerability in Dell OpenManage Enterprise versions prior to 4.8.0. Operators, administrators, and security teams responsible for Dell OpenManage Enterprise should review the vulnerability and take necessary actions.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact of the Cross-site Scripting vulnerability in Dell OpenManage Enterprise versions prior to 4.8.0.

• Information tampering may occur if the vulnerability is exploited
• Defenders should verify exposure and assess potential impact

Technical summary

Dell OpenManage Enterprise versions prior to 4.8.0 contain a Cross-site Scripting vulnerability. The vulnerability exists in the web page generation process, allowing an attacker to inject malicious scripts. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering. The vulnerability has a CVSS score of 6.8 and a severity of MEDIUM. Dell OpenManage Enterprise deployments should assess exposure and potential impact, and defenders should verify exposure and assess potential impact of the Cross-site Scripting vulnerability.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify exposure by checking Dell OpenManage Enterprise versions
• Assess potential impact on information tampering
• Review and update Dell OpenManage Enterprise to version 4.8.0 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The CVE record was published on 2026-11-02T13:17:40.347Z and has not been modified since then. The NVD entry also provides limited information about the vulnerability. Defenders should verify exposure and assess potential impact based on the available information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.