EUVD-2026-58687
GHSA-3x8v-3r2p-36vc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Network-accessible but requires high-privilege admin authentication; full C/I/A impact is consistent with server-side RCE via file upload.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.
AnalysisAI
Remote code execution in Dell Wyse Management Suite (WMS) is achievable by a high-privileged, remotely authenticated attacker through an unrestricted file upload vulnerability. All WMS versions prior to 2605.0.2 are affected, as confirmed by Dell advisory DSA-2026-329. While the CVSS impact is high across confidentiality, integrity, and availability, exploitation is gated behind administrative credentials, meaningfully constraining the realistic attacker population. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Dell Wyse Management Suite is an enterprise endpoint management platform for thin clients (Wyse terminals), commonly deployed in healthcare, finance, and large enterprise environments. The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), a root cause where the application fails to validate or restrict the type of files accepted through an upload interface - allowing an attacker to upload server-executable content such as web shells or malicious binaries. The CPE cpe:2.3:a:dell:wyse_management_suite_(wms):*:*:*:*:*:*:*:* confirms this affects the WMS application itself (not a third-party component). Because WMS manages endpoint fleets, a compromise of the management server can cascade to all managed thin clients.
RemediationAI
Upgrade Dell Wyse Management Suite to version 2605.0.2 or later, as directed by Dell advisory DSA-2026-329 (https://www.dell.com/support/kbdoc/en-us/000493271/dsa-2026-329-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities). If immediate upgrade is not feasible, restrict access to the WMS administrative console to trusted network segments only via firewall rules or VPN-gating - this does not eliminate the vulnerability but reduces the network exposure described in the CVSS AV:N vector. Additionally, enforce multi-factor authentication on all WMS administrative accounts to raise the bar for credential-based pre-exploitation; note this mitigates the privilege prerequisite but not the underlying CWE-434 flaw. Audit WMS upload directories for unexpected files as an interim detection measure.
More in Wyse Management Suite Wms
View allSQL injection in Dell Wyse Management Suite (WMS) versions prior to 2605 allows authenticated low-privileged remote atta
Authenticated SQL injection (CWE-89) in Dell Wyse Management Suite (WMS) before version 2605 lets a low-privileged remot
Local privilege-bound symlink abuse in Dell Wyse Management Suite (WMS) versions prior to 2605 allows a low-privileged l
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 enables a local low-privileged attac
Privilege escalation in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows a low-privileged local attack
Remote code execution is achievable in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 via an unrestricted f
Hard-coded credentials in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 expose management-plane access to
Remote unauthenticated information disclosure in Dell Wyse Management Suite (WMS) versions prior to 2605.0.2 allows netw
Dell Wyse Management Suite (WMS) versions prior to 2605 ships with default credentials, enabling a high-privileged local
Share
External POC / Exploit Code
Leaving vuln.today