Wyse Management Suite CVE-2026-81236

Exploitation requires network reachability to the Dell Wyse Management Suite server (the thin-client/VDI/kiosk management console) running a version prior to 2605.0.3.683; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against a reachable instance. The concrete precondition is the presence of the vulnerable unrestricted-upload endpoint, which accepts a dangerous file type that the server subsequently executes; Dell does not disclose the exact endpoint, required configuration, or whether any non-default feature must be enabled. Practical limiting factor: WMS is typically an internal enterprise management server, so exposure depends on whether it is internet-facing or confined to a management LAN - reducing the effective attack surface below what the AV:N/PR:N vector alone suggests.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) presents a maximal remote-unauthenticated profile: network-reachable, low complexity, no privileges, no user interaction, with full confidentiality/integrity/availability impact consistent with a file-upload-to-RCE chain (CWE-434). Against that severity, the exploitation-probability signals are markedly softer: EPSS is only 0.36% (30th percentile), there is no CISA KEV listing, and no public POC is referenced - so this is a high-CVSS issue whose real-world exploitation is not yet observed. The tension to state explicitly: CVSS models worst-case impact and reachability, while EPSS/KEV/POC indicate no evidence of active or automated exploitation at analysis time. No SSVC decision-point data was supplied for this specific CVE (a sibling in the same DSA-2026-387 batch carried SSVC exploitation=none/automatable=yes/impact=partial, but that cannot be assumed identical here). The upload mechanism is undisclosed in the advisory, so the true bar to weaponization (endpoint path, auth surface, file-type filtering) cannot be confirmed. Net: patch promptly given the unauthenticated-RCE profile on an internet- or LAN-reachable management server, but current telemetry points to latent/targeted rather than widespread exploitation.

A remote attacker who can reach the Wyse Management Suite server sends a crafted upload request placing a file of a dangerous type (e.g., a server-executable script or web payload) into a location the application will execute. When the uploaded file is invoked, attacker-controlled code runs on the management server, yielding control over the thin-client fleet it administers. No public exploit code is identified at time of analysis, and the exact upload endpoint/mechanism is undisclosed by Dell.