What is the CVSS score of CVE-2026-41120?

CVE-2026-41120 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Wyse Management Suite are affected by CVE-2026-41120?

Dell Wyse Management Suite (all versions prior to WMS 5.5 HF1) contains a critical remote code execution vulnerability allowing unauthenticated remote attackers to execute code on the management…

How to fix or mitigate CVE-2026-41120?

24 hours: Identify all Dell Wyse Management Suite deployments and document current versions; review system logs for exploitation attempts. 7 days: Upgrade all instances to WMS 5.5 HF1 or later; restrict network access to management suite via firewall rules limiting connectivity to authorized administrative networks. 30 days: Complete upgrade verification across all systems and conduct comprehensive access log audit for suspicious activity.

Wyse Management Suite CVE-2026-41120

EUVD-2026-39395 CRITICAL

Acceptance of Extraneous Untrusted Data With Trusted Data (CWE-349)

2026-06-25 dell

GHSA-5mhj-93x4-vf9f

Dell RCE Wyse Management Suite

9.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable RCE with low complexity and full impact; PR:L chosen to reflect Dell's 'low privileged attacker' wording over the input's PR:N, pending vendor confirmation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:27 vuln.today

DescriptionCVE.org

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

AnalysisAI

Remote code execution affects Dell Wyse Management Suite in all versions prior to WMS 5.5 HF1, stemming from the application's acceptance of extraneous untrusted data alongside trusted data (CWE-349). Per the provided CVSS vector (PR:N), a remote unauthenticated attacker could potentially achieve full code execution against the management server, though the Dell description text characterizes the actor as 'low privileged' - a discrepancy worth verifying. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Wyse Management Suite is Dell's centralized server platform for provisioning, configuring, and managing fleets of Wyse thin clients and endpoints, typically deployed as an on-premises or cloud management console. The root cause is CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data), a class of flaw where a component validates or trusts a legitimate portion of an input but then also processes attacker-supplied data that rides along with it - for example a request where signed/authenticated fields are honored while additional unsigned fields are accepted and acted upon. In an RCE context this typically means injected untrusted parameters or payloads are deserialized, executed, or passed to a privileged operation because they are bundled with otherwise trusted request data. The single affected CPE is cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:*:*:*:*, with the fix delivered in WMS 5.5 HF1.

RemediationAI

Vendor-released patch: upgrade to Dell Wyse Management Suite 5.5 HF1 or later, which remediates this vulnerability per Dell advisory DSA-2026-225 (https://www.dell.com/support/kbdoc/en-in/000465356/dsa-2026-225). Apply the hotfix as the primary fix. Until the upgrade is deployed, reduce exposure by restricting network access to the WMS console and its management ports to trusted administrative networks or a VPN/jump host rather than leaving it internet-facing, since the CVSS vector indicates network-based exploitation; the trade-off is reduced remote-admin convenience for distributed teams. Additionally place the WMS server behind a reverse proxy or WAF and monitor for anomalous requests to management endpoints, accepting that filtering RCE payloads for an untrusted-data-acceptance flaw is best-effort and not a substitute for the patch.