CVE-2026-54795

Executive Summary

CVE-2026-54795 is a high-severity OS command injection vulnerability (CWE-78) affecting Dell OpenManage Enterprise (OME) versions prior to 4.7.0. A low-privileged attacker with network access can exploit this flaw to execute arbitrary operating system commands on the underlying appliance host, leading to complete compromise of the management infrastructure (Confidentiality, Integrity, and Availability impacts are all rated HIGH). Given that OME is a centralized management platform for Dell PowerEdge servers, chassis, and storage, successful exploitation grants an attacker a privileged foothold into the broader IT management plane. As of this report, no public exploit code or in-the-wild exploitation has been confirmed, and the vulnerability remains unpatched per available tracker evidence — though upgrading to version 4.7.0 is the indicated remediation path.

Technical Analysis

The vulnerability is classified as an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), corresponding to CWE-78. This flaw class arises when an application constructs an operating system command using user-supplied input without adequate sanitization. In the context of Dell OpenManage Enterprise, the attack surface is the web-based management interface, which exposes numerous authenticated REST API endpoints and administrative functions to manage firmware, configurations, and health of Dell servers.

The attack mechanism is as follows: a low-privileged authenticated user sends a crafted HTTP request to a vulnerable endpoint. The endpoint accepts one or more parameters that are subsequently concatenated into a shell command (e.g., a call to system(), exec(), or popen() within the backend service). Because the input is not properly neutralized — i.e., shell metacharacters such as ;, |, &, $(), or backticks are not stripped or escaped — the attacker can inject arbitrary command sequences that the operating system executes with the privileges of the OME service account. This service account typically runs with elevated privileges on the appliance to perform hardware management functions, making the impact systemic.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is remotely exploitable without user interaction or special conditions beyond valid low-privilege credentials. The attack complexity is LOW, meaning no specific race conditions, timing windows, or unusual conditions are required. Because the impact scope is UNCHANGED, the compromise remains within the OME appliance itself, but the HIGH confidentiality/integrity/availability scores reflect that the appliance provides full administrative control over the managed hardware fleet.

No specific vulnerable endpoint paths, parameter names, or function names are provided in the NVD description. The lack of CNA title details further limits code-level attribution. Analysts should assume the flaw exists in multiple command-executing components of the OME web services layer. The affected version range is all releases prior to 4.7.0, indicating a broad exposure across existing deployments.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description; no public PoC exists, and specific implementation details are unavailable.

Step 1 – Reconnaissance/Infrastructure Discovery:
An attacker first identifies an exposed Dell OpenManage Enterprise appliance. This is typically accomplished via internet-wide scanning using services like Shodan (searching for OME web interfaces on default ports such as 443 or 8443), or via internal lateral movement after an initial foothold in the corporate network. The OME web interface presents a recognizable login page, confirming the target.

Step 2 – Authentication Bypass/Acquire Low-Privilege Access:
The attacker obtains valid low-privilege credentials through credential stuffing, weak-password guessing, phishing, or reuse of compromised corporate credentials. Given the CVSS vector specifies PR:L (low privileges required), the vulnerable functionality is accessible to standard users — it does not require an administrative account.

Step 3 – Triggering the Command Injection:
Using the authenticated session, the attacker crafts a request to a vulnerable OME API or management function that accepts user-controlled input (e.g., a device name, IP address, job parameter, or file path field). The request embeds OS command injection payloads into these fields. Common payload patterns at the class level include:

• Appending ; whoami or | id to a legitimate value to execute a benign command and confirm injection.
• Using $(command) or backticks in the parameter value to force command substitution.
• Chaining commands with && or || to ensure execution regardless of prior command success.

Because the description confirms the flaw is in OS command construction, the backend service will pass the composite string to a shell interpreter. The injected commands execute with the privileges of the OME service process.

Step 4 – Post-Exploitation Impact:
Once arbitrary command execution is achieved, the attacker can:

• Extract configuration data, credentials, and secrets from the appliance's filesystem.
• Use the OME appliance as a pivot to reach the managed Dell iDRAC interfaces and other infrastructure (the appliance holds credentials for managed nodes).
• Deploy persistent backdoors (e.g., webshells, cron jobs, or SSH keys) to maintain access.
• Disrupt management operations, causing denial-of-service across the managed hardware estate.
• In a worst-case scenario, if the OME service runs as root (typical for such appliances), the attacker gains full root privileges over the management server.

In-the-Wild Status: No public exploit code, Metasploit module, or Nuclei template exists as of this writing. The attack chain above is a realistic inference based on the vulnerability class and known patterns from similar Dell and enterprise management appliance flaws (e.g., previous OME command injection incidents). No CISA KEV listing is present, indicating no confirmed active exploitation at the time of reporting.

Impact Assessment

Business Impact: Dell OpenManage Enterprise is the centralized management console for Dell EMC server fleets. A successful exploit grants an attacker command execution on the management plane, which is equivalent to controlling the entire hardware estate's lifecycle — firmware updates, BIOS settings, power management, and monitoring. The blast radius extends beyond the single appliance:

• Managed Node Compromise: OME stores iDRAC credentials and network paths for every managed server. An attacker can extract these to directly access iDRAC interfaces (out-of-band management controllers), providing hardware-level control and persistence that bypasses the operating system.
• Lateral Movement: The OME appliance sits in a privileged network position with connectivity to management VLANs. Command execution enables further pivoting into the data center network.
• Availability: An attacker can shut down or brick managed servers by pushing malicious firmware updates or power cycles, resulting in operational downtime for critical workloads.
• Compliance/Regulatory: For organizations managing PCI-DSS, HIPAA, or other regulated environments, compromise of the management plane may trigger mandatory breach disclosure and significant fines.

CVSS Subscore Analysis:

• AV:N / AC:L — Remote, uncomplicated exploitation.
• PR:L — Attacker needs only a low-privilege account; eliminates the need for admin credentials but still requires valid authentication.
• UI:N — No user interaction required for the victim.
• S:U — Scope is unchanged; the compromise is contained to the OME appliance process domain.
• C:H/I:H/A:H — Full confidentiality, integrity, and availability loss on the appliance and, through it, the managed infrastructure.

Affected Systems: All Dell OpenManage Enterprise deployments running any version prior to 4.7.0. This includes on-premises virtual appliances and physical OME appliances deployed in data centers worldwide. The exposure is likely concentrated in enterprise environments with large Dell server fleets.

Detection Guidance

The following detection content is designed to catch exploitation attempts based on the vulnerability class (OS command injection in an authenticated web management interface). These rules are generic and should be tuned to the environment's OME traffic and log baselines. Since no specific endpoint or payload is public, detections focus on anomaly signals: shell metacharacters in web request parameters, unexpected process executions on the OME host, and non-standard outbound connections.

Sigma Rule

title: Dell OpenManage Enterprise - Suspicious Shell Metacharacters in Web Request
id: 5f3a8c1e-2b1a-4f7d-9e6c-0a1b2c3d4e5f
status: experimental
description: Detects web requests to Dell OpenManage Enterprise containing shell metacharacters (;, |, &, $, backtick) in query parameters or POST body, indicating potential OS command injection (CVE-2026-54795).
author: Valters IT Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: dell_openmanage_enterprise
  service: httpd
detection:
  selection:
    cs-uri-query|contains:
      - ';'
      - '|'
      - '&'
      - '$('
      - '`'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate use of special characters in search or query functions (rare)
  - Malformed requests from misconfigured monitoring tools
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-54795
  - cwe.78

YARA Rule

rule CVE_2026_54795_OpenManage_Command_Injection {
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects payload patterns indicating OS command injection against Dell OpenManage Enterprise"
        date = "2026-02-15"
        cve = "CVE-2026-54795"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54795"
        severity = "high"
    strings:
        $s1 = "OpenManage Enterprise" nocase
        $s2 = "cmd=" ascii nocase
        $s3 = ";whoami" ascii nocase
        $s4 = "|id" ascii nocase
        $s5 = "$(cat /etc/passwd)" ascii
        $s6 = "`ifconfig`" ascii
        $s7 = "&&wget" ascii nocase
        $s8 = "||nc " ascii nocase
    condition:
        $s1 and 1 of ($s2, $s3, $s4, $s5, $s6, $s7, $s8)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-54795 - Dell OpenManage Enterprise OS Command Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"OpenManage"; http_uri; nocase; content:";"; http_client_body; distance:0; within:100; content:"whoami"; http_client_body; distance:0; within:100; classtype:attempted-admin; sid:5479501; rev:1; metadata:created_at 2026_02_15, cve CVE-2026-54795, cwe CWE-78;)

Alternative broader Suricata rule without specific URI match (more false positives but better coverage for unknown endpoints):

alert http any any -> $HOME_NET any (msg:"CVE-2026-54795 - Suspicious Shell Metacharacters in HTTP Body (Potential OS Command Injection)"; flow:established,to_server; content:"|3b|"; http_client_body; content:"|7c|"; http_client_body; content:"|26|"; http_client_body; threshold:type limit, track by_src, count 3, seconds 60; classtype:attempted-admin; sid:5479502; rev:1; metadata:created_at 2026_02_15, cve CVE-2026-54795;)

Note: Hex-encoded pattern |3b| = ;, |7c| = |, |26| = &.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [network where destination.ip != null and destination.port != 443 and network.protocol == "http" and process.name == "java" or process.name == "httpd"]
  [process where event.type in ("start", "exec") and (
    process.name in ("sh", "bash", "cmd.exe", "powershell.exe") and
    process.command_line != null and (
      process.command_line regex~ ".*(;|\\||&|\\$\\()\\s*(whoami|id|cat|nc|wget|curl).*"
    )
  )]

Alternative simpler EQL for a Windows environment (if OME is on Windows — note Dell OME typically runs on a Linux appliance, but for completeness):

process where event.type == "start" and 
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe") and 
  process.command_line contains "OpenManage" or process.command_line contains "ome"

Splunk SPL Query

index=webserver sourcetype=iis OR sourcetype=apache*
  (uri_path="*OpenManage*" OR uri_path="*ome*")
  AND (
    form_data="*;*" OR form_data="**|**" OR form_data="*%3B*" OR form_data="*%7C*" OR
    query="*;whoami*" OR query="*|id*" OR query="*$(which nc)*" OR query="*`ifconfig`*"
  )
  OR
index=os sourcetype=linux_secure*
  (COMMAND="*sh -c*" OR COMMAND="*bash -c*") 
  AND COMMAND="*whoami*"
  AND host="*ome*"

Alternative SPL query for post-exploitation behavior on the OME host:

index=linux sourcetype=syslog
  host="*ome*"
  (COMMAND="*whoami*" OR COMMAND="*cat /etc/shadow*" OR COMMAND="*ssh*" OR COMMAND="*cron*")
  NOT (COMMAND="*normal_backup*")

Wazuh OSSEC Rule

<group name="dell_ome,">
  <rule id="547950" level="12">
    <if_sid>31510</if_sid> <!-- Parent rule for web server access log analysis -->
    <field name="url">\.*OpenManage.*|\.*ome.*</field>
    <description>CVE-2026-54795: Suspicious shell metacharacters in Dell OpenManage Enterprise request.</description>
    <match>;|%3B||%7C|&|%26|\$\(|`</match>
    <group>attack.initial_access,cve.2026-54795,cwe.78,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="547951" level="15">
    <if_sid>5710</if_sid> <!-- Parent rule for command execution audit logs -->
    <field name="command">\.*sh -c.*|\.*bash -c.*</field>
    <match>whoami|id|cat /etc/passwd|nc |/dev/tcp</match>
    <description>CVE-2026-54795: Post-exploitation command execution pattern on Dell OME host.</description>
    <group>execution,cve.2026-54795,</group>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The patch confidence is 0/4 — UNPATCHED per available trackers. No vendor advisory or patch bulletin has been released referencing a specific fixed build beyond the version constraint (4.7.0) in the NVD description. Organizations should verify with Dell directly whether 4.7.0 is GA, and monitor the Dell Security Advisory portal for an official fix reference.

Immediate Mitigations (while unpatched):

1. Access Restriction: Place the OME web interface behind a firewall/VPN and restrict access to a trusted management subnet. Do not expose it to the internet. If remote access is required, use a jump-host with strong MFA.
2. Least Privilege: Audit all OME local accounts and remove any unused accounts. Enforce strong password policies. Disable default accounts if not strictly needed.
3. Network Segmentation: Isolate the OME appliance in a dedicated management VLAN with strict egress rules. Disable outbound internet access and limit management-plane connectivity.
4. Continuous Monitoring: Apply the Sigma/Splunk/Elastic detection content above to immediately flag injection attempts on the appliance's web logs and the host OS command audit logs.
5. Temporary Workaround: If the vulnerable component can be identified in the specific deployment (e.g., a particular feature), consider disabling that feature via the OME security settings if operationally acceptable.

Patch/Upgrade Steps:

1. Check the current OME version via the appliance admin UI (About section).
2. If below 4.7.0, download the 4.7.0 release from Dell's support site (dell.com/support) once it is confirmed available.
3. Follow the documented upgrade procedure: backup the OME database and configuration first, then apply the update during a maintenance window.
4. After upgrade, verify the version and re-run the detection rules to confirm no residual indicators.

Long-Term Hardening:

1. SSO/AD Integration: Integrate OME with corporate AD and enforce MFA on all management accounts to reduce the likelihood of credential compromise at the low-privilege level.
2. Audit Log Forwarding: Forward OME audit logs to a centralized SIEM (e.g., via syslog) for long-term retention and correlation.
3. Regular Patching Cadence: Subscribe to Dell Security Advisory notifications to stay ahead of future OME Vulnerabilities.
4. Replace/Retire Legacy: For legacy deployments, evaluate whether OME can be replaced with Dell OpenManage Enterprise Modular or newer management alternatives that may have improved security fundamentals.
5. Firmware Baseline Controls: Restrict who can execute firmware update jobs through OME; review job approval workflows to limit blast radius even if the management plane is compromised.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-54795
2. Dell Security Advisories Portal — https://www.dell.com/support/security/advisories (General adisories page; monitor for a future advisory referencing CVE-2026-54795)
3. CWE-78 Definition — https://cwe.mitre.org/data/definitions/78.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-54795 is NOT listed; check periodically for updates)

Threat Actor/ITW Evidence: No known threat actor campaigns or exploit-in-the-wild activity have been reported for CVE-2026-54795 as of this report. The lack of public exploit code, Nuclei templates, and CISA KEV listing suggests the vulnerability has not yet attracted widespread attention. However, given the high CVSS score (8.8) and the device's exposure profile (management interface), exploitation is probable once details are more widely publicized. Enterprises with exposed OME instances should treat this as a priority ONE issue and apply network-level controls immediately.