Dell Wyse Management Suite EUVD-2026-78910

No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/PR:N/UI:N) against Dell Wyse Management Suite servers running versions prior to 2605.0.3.683. Exploitation requires network reachability to the WMS server's file-upload functionality; the specific feature/endpoint is not disclosed by Dell. Practical risk is limited by the product's typical deployment on internal enterprise management networks rather than internet-facing, and by the absence of public exploit code, meaning an attacker must reconstruct the undisclosed upload mechanism.

This is a genuinely high-priority vulnerability on paper: the Dell-issued CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with total impact (C:H/I:H/A:H), which is the classic unrestricted-file-upload-to-webshell RCE profile scoring 9.8. However, the real-world signals temper this: EPSS is only 0.36% (30th percentile), there is no CISA KEV listing, and no public exploit code has been identified, so exploitation is not confirmed active or widespread at time of analysis. The high CVSS reflects worst-case potential rather than observed activity. The description itself is hedged ('could potentially exploit'), and Dell does not disclose the vulnerable endpoint or upload mechanism, so a working exploit is not trivially reconstructable from public data alone. Net: treat as a real priority to patch given the unauthenticated-RCE profile and internet-adjacent management role of the product, but current telemetry (low EPSS, no KEV, no POC) indicates it is not yet under mass exploitation. Note this is a direct sibling of CVE-2026-81240 (same product, version, CWE-434, and DSA-2026-387 advisory batch).

An unauthenticated attacker with network access to a Dell Wyse Management Suite server sends a crafted HTTP request that uploads a file of a dangerous type (e.g., a server-executable script/webshell) to a location the server will process. When the uploaded file is subsequently executed by the server, the attacker gains remote code execution on the management host. No public exploit code has been identified at time of analysis, and Dell does not disclose the vulnerable endpoint, so weaponization requires additional research.