EUVD-2026-58683
GHSA-ph33-mmf6-2qfv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector and low-privilege requirement are consistent with needing an existing local session to deliver a deserialization payload; full C/I/A impact on the local system upon successful privilege escalation.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Improper Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
AnalysisAI
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attacker to fully compromise the host system through improper deserialization of untrusted data. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact scoped to the vulnerable system. No public exploit code has been identified and EPSS places this at the 0th percentile for near-term exploitation likelihood; however, SSVC rates the technical impact as total, meaning successful exploitation results in complete system compromise for any attacker already holding local access.
Technical ContextAI
Dell Wyse Management Suite is an enterprise endpoint management platform used to centrally deploy, configure, and monitor thin client devices - common in healthcare, retail, and financial verticals. The vulnerability involves improper deserialization of untrusted data submitted to a local WMS component, where the application processes attacker-controlled serialized objects without adequate validation, allowing manipulation of application runtime behavior. Notably, the assigned CWE is CWE-269 (Improper Privilege Management) rather than CWE-502 (Deserialization of Untrusted Data), which conflicts with both the description and the 'Deserialization' tag - this may reflect a dual-nature flaw where the deserialization mechanism is the exploit vector and the privilege mismanagement is the resulting impact class. Affected products are identified by CPE cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:*, covering all WMS versions up to but not including 2605.0.2.
RemediationAI
Upgrade Dell Wyse Management Suite to version 2605.0.2 or later, as specified in Dell Security Advisory DSA-2026-329 at https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities. This is the only confirmed fix. As a compensating control prior to patching, restrict interactive and remote desktop logon rights on WMS servers to only authorized administrators using Group Policy or equivalent mechanisms - this limits the pool of accounts that could supply malicious serialized data locally. Additionally, implement privileged access workstations (PAWs) or jump-server controls to prevent low-privileged users from obtaining any local session on the WMS host. These controls reduce the attack surface but do not eliminate the underlying flaw and should not substitute for patching. Monitor WMS host systems for anomalous privilege escalation events or unexpected high-privilege process spawning.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated att
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today