Wyse Management Suite CVE-2026-41120

Network reachability to the Wyse Management Suite server is required. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no user interaction and no authentication are indicated, meaning exploitation against a network-exposed, unpatched WMS instance prior to 5.5 HF1 needs no special configuration - however, Dell's description explicitly says a 'low privileged attacker' is needed, which contradicts PR:N and suggests some level of authenticated access may actually be required; this must be confirmed with the Dell advisory before assuming pure unauthenticated exploitation. Limiting factors: the WMS console should not be exposed to untrusted networks in a hardened deployment, so internet-facing or flat-network installations are at materially higher risk than segmented ones.

The supplied CVSS 3.1 base score is 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - network-reachable, low complexity, no privileges, no user interaction, and full confidentiality/integrity/availability impact. That signal alone makes this a high-priority patch candidate for any exposed management console. However, there is a notable internal conflict: the CVSS vector asserts PR:N (no privileges) while Dell's narrative description states a 'low privileged attacker' is required - this should be confirmed with Dell DSA-2026-225, because the real-world barrier differs significantly between unauthenticated and authenticated exploitation. No EPSS score was provided, the CVE is not in CISA KEV, and no public proof-of-concept was identified, so there is currently no evidence of active or imminent mass exploitation; the priority here rests on the criticality of the asset (a fleet management server) and the CVSS rating rather than on observed exploitation. SSVC inputs (automatable, exploitation status) were not provided in the source data.

An attacker who can reach the Wyse Management Suite server over the network sends a crafted request in which malicious untrusted data is bundled with otherwise-trusted request fields; the server accepts and acts on the extraneous data, resulting in code execution on the management host. No public exploit is currently available, but given AV:N/AC:L the technical barrier is low if an attacker reverse-engineers the patch, potentially yielding control over every managed thin client.