{"id":"CVE-2026-91912","kind":"vulnerability","aliases":["CVE-2026-91912"],"related":[],"title":"Dell OpenManage Enterprise: hard-coded cryptographic key leaks data to local users","description":"Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.","summary":"Dell OpenManage Enterprise before 4.8.0 ships with a hard-coded cryptographic key. A low-privileged user with local access could exploit it to read information that should be protected.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell","infrastructure","on-prem","openmanage-enterprise"],"not_affected_if":["version-4.8.0-or-later"],"how_to_check":"- Check the installed OpenManage Enterprise version in the appliance console or UI; versions below `4.8.0` are listed as affected.","fix":"- Dell OpenManage Enterprise: move to `4.8.0` or later (per the advisory range prior to 4.8.0).","status":"open","published_at":"2026-10-30T14:17:10+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","triaged_at":"2026-10-30T14:32:40+00:00","updated_at":"2026-10-30T14:32:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-30T14:32:40Z","model":"claude-haiku-5-5","output":{"fix":"- Dell OpenManage Enterprise: move to `4.8.0` or later (per the advisory range prior to 4.8.0).","reach":"local","title":"Dell OpenManage Enterprise: hard-coded cryptographic key leaks data to local users","impact":"medium","summary":"Dell OpenManage Enterprise before 4.8.0 ships with a hard-coded cryptographic key. A low-privileged user with local access could exploit it to read information that should be protected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dell","openmanage-enterprise","on-prem"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local low-privilege user reads protected information","analyst_note":"Confirm the CVSS vector and the Dell advisory text at https://nvd.nist.gov/vuln/detail/CVE-2026-91912 for scope of the leaked key and any workaround.","how_to_check":"- Check the installed OpenManage Enterprise version in the appliance console or UI; versions below `4.8.0` are listed as affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-4.8.0-or-later"],"who_is_affected":"Teams running Dell OpenManage Enterprise below version 4.8.0 on servers they manage. Exposure depends on local access to the appliance by a low-privileged account; sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000683,"input_tokens":4125,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-91912':16A,19A '4.8.0':32B,65C 'access':48B,82C 'attack':79C 'code':6A,38B,72C 'contain':66C 'could':49B,83C 'cryptograph':7A,39B,73C 'cve':14A,17A 'data':10A 'dell':1A,20B,28B,59C 'disclosur':91C 'enterpris':3A,27B,30B,61C 'exploit':50B,85C 'hard':5A,37B,71C 'hard-cod':4A,36B,70C 'inform':54B,90C 'infrastructur':21B 'key':8A,40B,74C 'lead':88C 'leak':9A 'local':12A,47B,81C 'low':43B,77C 'low-privileg':42B 'on-prem':22B 'openmanag':2A,26B,29B,60C 'openmanage-enterpris':25B 'potenti':84C 'prem':24B 'prior':63C 'privileg':44B,78C 'protect':58B 'read':53B 'ship':33B 'use':68C 'user':13A,45B 'version':62C 'vulner':75C,87C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell OpenManage Enterprise below version 4.8.0 on servers they manage. Exposure depends on local access to the appliance by a low-privileged account; sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T14:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91912","severity":null,"published_at":"2026-10-30T14:17:10+00:00","modified_at":"2026-10-30T14:17:10+00:00","first_seen_at":"2026-10-30T14:30:54+00:00","fetched_at":"2026-10-30T14:30:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}