What is the CVSS score of CVE-2026-49506?

CVE-2026-49506 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Wyse Management Suite are affected by CVE-2026-49506?

A remote code execution vulnerability in Dell Wyse Management Suite (versions prior to 5.5 HF1) allows high-privileged authenticated users to execute arbitrary code on the management server through a…

How to fix or mitigate CVE-2026-49506?

Within 24 hours: Inventory all Dell Wyse Management Suite deployments to identify affected versions and assess business criticality. Within 7 days: Restrict administrative access to essential personnel only, implement multi-factor authentication for all high-privilege accounts, and enable comprehensive audit logging of administrative activities. Within 30 days: Monitor Dell security advisories for patch availability; implement network segmentation to isolate the management server if not already segregated; test and deploy patches as released by Dell.

Wyse Management Suite CVE-2026-49506

EUVD-2026-39391 HIGH

Path Traversal (CWE-22)

2026-06-25 dell

GHSA-22f4-hrhx-4j5v

Dell Path Traversal RCE Wyse Management Suite

7.2

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management console (AV:N, AC:L) but exploitation requires an administrative WMS account (PR:H); path-traversal RCE yields full host compromise, so C/I/A:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:26 vuln.today

DescriptionCVE.org

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

AnalysisAI

Remote code execution in Dell Wyse Management Suite (versions prior to WMS 5.5 HF1) is reachable through a path traversal flaw (CWE-22) that lets an authenticated, high-privileged remote attacker access or write files outside the intended directory and ultimately execute arbitrary code on the management server. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability impact gated by a high-privilege requirement. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Wyse Management Suite (WMS) is Dell's centralized console for provisioning, configuring, and managing fleets of Wyse thin clients and ThinOS/Windows endpoints, typically deployed on a Windows server inside enterprise VDI environments. The affected component is identified by CPE cpe:2.3:a:dell:wyse_management_suite. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): user-controllable path input is not properly canonicalized or constrained to an intended base directory, so sequences such as '../' allow references to arbitrary filesystem locations. Because WMS performs file operations (firmware/image uploads, configuration packages, logs) under the service's privileges, a traversal primitive can be leveraged to drop or overwrite files in sensitive locations, which Dell states can escalate to remote code execution on the host.

RemediationAI

Vendor-released patch: WMS 5.5 HF1 - upgrade Wyse Management Suite to version 5.5 HF1 or later as directed by Dell advisory DSA-2026-225 (https://www.dell.com/support/kbdoc/en-in/000465356/dsa-2026-225), which is the primary and recommended fix. Until the upgrade is applied, reduce exposure by restricting network access to the WMS management console and its API to trusted administrative networks only (for example via firewall rules or placing it behind a VPN/jump host), since the attack vector is network-based; this limits reachability but does not remove the flaw. Additionally, tighten and audit the set of high-privileged WMS accounts and rotate/limit administrative credentials, because exploitation requires high privileges (PR:H) - the trade-off is operational overhead and possible friction for legitimate admin workflows. No vendor-confirmed feature-level workaround was published in the available data, so patching remains the only complete remediation.