CVE-2026-94349 explained: the Dell Openmanage Enterprise flaw and how to fix it

The two-minute check

1. Open a browser and go to the web address your IT team uses to manage Dell servers.
2. Look at the login screen or the About page for a version number.
3. If the version shown is older than 4.8.0, this applies to you.
4. If you don't recognize this console, ask whoever manages your servers whether they use it.

When you can stop reading

If your business doesn't run Dell servers, or your IT provider confirms you don't use Dell OpenManage Enterprise, this flaw does not apply to you. You can close this tab.

What the official record says

The National Vulnerability Database (NVD) gives CVE-2026-94349 a Common Vulnerability Scoring System (CVSS) score of 8, rated HIGH (NVD). The scoring details say an attacker needs to already be on your local network, not the open internet. They also need a low-level account on the system, but they don't need you to click anything. If they succeed, they can run commands on the server, which can expose, change, or take down whatever that server handles.

The same update also fixes nine related flaws, tracked as CVE-2026-91909, CVE-2026-91908, CVE-2026-91905, CVE-2026-91911, CVE-2026-91907, CVE-2026-91903, CVE-2026-91910, CVE-2026-91906, and CVE-2026-91904. The record doesn't say which of these has been used in an actual attack. This flaw is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, so there's no sign of active exploitation right now.

What that means for a business like yours

Your server management console usually sits on your internal network, away from the open internet. That limits who can reach it. But a low-level account is often easier to get than people assume — a shared password, an old vendor login, or a compromised workstation on the same network segment could be enough. Once in, an attacker could reach whatever that console manages, which for most businesses means core servers running email, files, or line-of-business software.

If someone else manages your IT

Send this to your IT provider or internal team:

"Please confirm our Dell OpenManage Enterprise console is updated to version 4.8.0 or later. This fixes CVE-2026-94349 and nine related flaws covered by the same update. Please let us know once it's done."

If you manage it yourself

1. Go to the Dell security advisory for this update.
2. Find the download listed for your current OpenManage Enterprise version.
3. Log in to the console as an administrator.
4. Follow the install steps listed on that advisory page.
5. Restart the service if the installer prompts you to.
6. Log back in and check that the version number now reads 4.8.0 or later.

There's no confirmed exploitation of this flaw yet, and it isn't on the CISA KEV catalog. That can change without warning if someone publishes working attack code. Given the score of 8 HIGH and the fact that an attacker only needs network access and a low-level account, a sensible target is to patch within the next two to three weeks. If this console sits on a network segment that's hard to reach from outside, you have a bit more breathing room. If it's reachable from a broad internal network that many people and devices touch, treat it as higher priority.

Don't rely on an installer's progress bar finishing. Log back into the OpenManage Enterprise console yourself. Check the version number on the login screen or About page. It should now read 4.8.0 or later. If it still shows an older version, the update didn't take, and you should try again or contact your provider.

If you can't patch immediately, you can reduce your exposure in the meantime. Restrict which devices on your network can reach the OpenManage Enterprise console, ideally to a small, trusted management segment. This limits who could even attempt to exploit the flaw, though it doesn't fix the underlying bug. Review who holds accounts on this console and remove any that aren't actively needed; fewer low-level accounts means fewer ways in. A privileged access management approach can help control and monitor who has administrative access to systems like this one. None of these steps replace the patch. They just buy you time until you can apply it.

Do I have to do anything if we don't run Dell servers?

No. This flaw only affects Dell OpenManage Enterprise. If you don't run that console, there's nothing to patch here.

Will patching break anything?

The record doesn't describe specific compatibility issues. As with any update, it's good practice to apply it during a planned maintenance window and confirm the console still works as expected afterward.

What if we don't know what version we're running?

Check the login screen or About page inside the console itself. If you still can't tell, ask whoever set up or manages your Dell servers; they'll be able to confirm the version for you.

Is this being actively exploited right now?

The record shows no confirmed exploitation, and this flaw isn't on the CISA Known Exploited Vulnerabilities (KEV) catalog. That status can change, which is why patching sooner rather than later is still worthwhile.

Does this affect our regular office computers?

Only if the computer, phone, or server you run Dell OpenManage Enterprise on is one of your office machines. For most businesses, this console runs on a dedicated management server, not everyday workstations.

If you'd like help confirming whether this affects your environment, LayerLogix can review your setup as part of a broader look at your managed IT and cybersecurity posture. Start with a free IT assessment or contact us directly.