CVE-2026-111505: Dell OpenManage Command Injection
Two command-injection flaws rated 8.8 in Dell OpenManage Enterprise below 4.8.0. The console becomes a pivot to managed servers. Upgrade required.
Who is affected
- Dell OpenManage Enterprise, versions prior to 4.8.0
- PowerEdge server fleets managed through OpenManage at a hotel, group or in-house data center
- Administrator workstations and consoles reachable on the OpenManage management network
How to fix
Upgrade OpenManage Enterprise to version 4.8.0, which fixes the entire batch published under advisory DSA-2026-467. Until then, restrict network reach of the console (dedicated management VLAN, access control list, no exposure on guest or corporate Wi-Fi). Audit accounts: exploitation requires an account, however low-privileged, so an unknown service account is a warning sign. Review console audit logs since October 30, and if abnormal command execution is found, treat every managed server as potentially impacted.
What happened
On October 30, 2026, NVD published sixteen vulnerabilities from Dell advisory DSA-2026-467 covering OpenManage Enterprise, the management console for PowerEdge servers. Two are OS command injections scored 8.8 (CVE-2026-111505 and CVE-2026-91913): an attacker with network access and low privileges can trigger command execution on the console itself. The batch also includes an 8.0 flaw, 7.8 and 7.2 issues, and a hardcoded cryptographic key (CVE-2026-91912, 7.3). All are fixed in version 4.8.0. No exploitation has been reported as of this writing.
Why it matters for a hotel
Many properties and groups host their property management system, file server or point-of-sale backend on Dell PowerEdge boxes in a back-of-house rack, managed by OpenManage. The console is a privilege-escalation point by design: whoever controls it can push actions to every managed server. A flaw reachable by a low-privileged attacker already on the network (a compromised guest device, a poorly segmented VLAN) turns the console into a springboard into the whole estate. That profile matches ransomware campaigns that inventory first and strike second.
Who is affected
OpenManage Enterprise in every version prior to 4.8.0. The version number appears in the console interface, in the footer or the About menu. Exposure depends first on who can reach the console: network reach is enough to attempt exploitation with a weak account.
How to fix
- Upgrade to OpenManage Enterprise 4.8.0, which covers all sixteen CVEs in the DSA-2026-467 batch.
- Isolate the console: a dedicated management network or VLAN, access filtering, no route from guest networks or guest Wi-Fi.
- Audit accounts and sessions: exploitation requires an account, so unknown or recently created service accounts must be justified or removed.
- Re-read audit logs since October 30: unexpected command executions, settings changes, created tasks.
- If an abnormal trace is found, treat every managed server as potentially impacted and bring in incident response before reconnecting the console.
Context
Published in the same vendor cycle, Dell notice DSN-2026-003 and advisory DSA-2026-475 extend php2shell coverage to the Cyber Detect and PowerProtect tooling HotelSec already tracks. The OpenManage batch reinforces a segmentation principle: an administration console has no business sitting on a network a guest device can cross, and patching it matters as much as patching the servers it commands.