---
id: "CVE-2026-91914"
kind: "vulnerability"
aliases: ["CVE-2026-91914"]
title: "Dell OpenManage Enterprise: authentication bypass by spoofing lets attackers steal sessions"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["dell", "infrastructure", "on-prem", "openmanage-enterprise", "self-hosted"]
not_affected_if: ["console-not-on-adjacent-network", "version-4.8.0-or-later"]
published_at: "2026-10-30T14:17:10+00:00"
first_seen_at: "2026-10-30T14:30:54+00:00"
updated_at: "2026-10-30T14:32:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91914", "first_seen_at": "2026-10-30T14:30:54+00:00"}]
---

# Dell OpenManage Enterprise: authentication bypass by spoofing lets attackers steal sessions

Dell OpenManage Enterprise versions before 4.8.0 contain an authentication bypass by spoofing flaw. An unauthenticated attacker on the adjacent network could potentially steal a session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenManage Enterprise version in the web console or on the appliance; compare it with `4.8.0`.
- Confirm whether the management console is reachable from networks outside the administrators' segment.

## Fix

- Dell OpenManage Enterprise: move to `4.8.0` or later.

## Timeline

- 2026-10-30T14:30:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91914

## From the sources

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_