EUVD-2026-38341
GHSA-8qxf-7fxx-743x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local logon required (AV:L) with a standard user account (PR:L); symlink primitive is reliable (AC:L) and the privileged WMS service operation yields full CIA impact on the host.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.
AnalysisAI
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged local user to gain unauthorized access to files or resources they should not reach. The flaw is rooted in improper link resolution before file access (CWE-59), and while no public exploit has been identified at time of analysis, the CVSS 7.8 score reflects full confidentiality, integrity, and availability impact once the local prerequisite is met.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must already have interactive or remote-shell local logon to the Windows host running Dell Wyse Management Suite prior to 2605, with a standard (non-administrator) user account that can create files and symbolic links in a directory touched by the WMS service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with a local low-privileged user achieving full CIA impact, which is the classic signature of a local privilege escalation via symlink abuse rather than a remote network exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user on a Windows server hosting Dell Wyse Management Suite (for example, a help-desk operator account or a compromised service account) plants a symbolic link in a directory the WMS service writes to, pointing at a sensitive system file or a configuration file owned by SYSTEM. When the WMS service next performs its file operation, it follows the link and reads, overwrites, or deletes the attacker-chosen target, yielding privilege escalation or disclosure of protected data. … |
| Remediation | Vendor-released patch: upgrade Dell Wyse Management Suite to version 2605 or later per Dell DSA-2026-247 (https://www.dell.com/support/kbdoc/en-us/000472001/dsa-2026-247), which is the primary and recommended fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Dell WMS deployments and identify instances running versions prior to 2605; restrict local user login access to WMS systems to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
SQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
SQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Share
External POC / Exploit Code
Leaving vuln.today