What is the CVSS score of CVE-2026-44274?

CVE-2026-44274 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dell Wyse Management Suite are affected by CVE-2026-44274?

Dell Wyse Management Suite versions prior to 2605 contain a privilege escalation vulnerability (CVE-2026-44274) that allows unprivileged local users to gain unauthorized access to sensitive system…. A patch is available.

How to fix or mitigate CVE-2026-44274?

Within 24 hours: Inventory all Dell WMS deployments and identify instances running versions prior to 2605; restrict local user login access to WMS systems to essential personnel only. Within 7 days: Implement mandatory access controls and file integrity monitoring on affected WMS servers; enable alerting for unauthorized file access attempts and symlink operations; isolate WMS systems to dedicated network segments where feasible. Within 30 days: Upgrade all affected instances to Dell WMS version 2605 or later once available; conduct post-upgrade validation testing.

Dell Wyse Management Suite CVE-2026-44274

EUVD-2026-38341 HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-06-22 dell

GHSA-8qxf-7fxx-743x

Authentication Bypass Dell Wyse Management Suite Wms

7.8

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local logon required (AV:L) with a standard user account (PR:L); symlink primitive is reliable (AC:L) and the privileged WMS service operation yields full CIA impact on the host.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 22, 2026 - 21:02 EUVD

Analysis Generated

Jun 22, 2026 - 20:15 vuln.today

DescriptionCVE.org

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

AnalysisAI

Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged local user to gain unauthorized access to files or resources they should not reach. The flaw is rooted in improper link resolution before file access (CWE-59), and while no public exploit has been identified at time of analysis, the CVSS 7.8 score reflects full confidentiality, integrity, and availability impact once the local prerequisite is met.

Technical ContextAI

Dell Wyse Management Suite is an on-premises and cloud management platform used by enterprises to provision, configure, and monitor Wyse thin clients and ThinOS endpoints. The underlying weakness, CWE-59 (Improper Link Resolution Before File Access, also known as 'Link Following'), occurs when a privileged process operates on a file path without first verifying that the path does not traverse a symbolic link or junction created by an unprivileged user. In practice, a WMS service process running with elevated rights likely opens, writes to, or deletes a file in a predictable location (logs, temp, working directories) where a lower-privileged local user can pre-stage a symlink, causing the privileged process to act on an attacker-chosen target. The CPE cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:* covers all WMS application versions, and Dell's fix lands in WMS 2605.

RemediationAI

Vendor-released patch: upgrade Dell Wyse Management Suite to version 2605 or later per Dell DSA-2026-247 (https://www.dell.com/support/kbdoc/en-us/000472001/dsa-2026-247), which is the primary and recommended fix. Until WMS 2605 can be deployed, restrict interactive and remote-shell logon to the WMS server to administrators only - removing low-privileged local accounts eliminates the AV:L/PR:L precondition, at the cost of reducing operational separation of duties; additionally, audit and tighten ACLs on WMS installation, log, and temp directories (typically under the WMS program data path) so non-admin users cannot create files or symbolic links there, and consider disabling the Windows SeCreateSymbolicLinkPrivilege for non-administrator users on the WMS host to block the symlink primitive entirely, accepting that some developer tooling on that host may break.