EUVD-2026-78915
GHSA-fh59-w4cp-j4f8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Network-reachable upload path with no authentication or interaction per PR:N/UI:N; integrity impact dominates as attacker-controlled files land on the server.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0.3.683, caused by an unrestricted file upload (CWE-434) that lets an attacker place a file of a dangerous type on the server. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are required, and the high integrity impact (I:H) reflects the ability to modify or replace server-side content with attacker-controlled code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Dell Wyse Management Suite server be network-reachable by the attacker (per AV:N) and that its file upload functionality be exposed and processing uploads without an authenticated session (per PR:N and UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L is a genuinely serious shape: network-reachable, low complexity, no privileges and no user interaction, with the high integrity metric reflecting an attacker-controlled file landing on the server - the classic path to a web shell and then to full server compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell Wyse Management Suite to version 2605.0.3.683 or later; this is the fix version named in Dell advisory DSA-2026-387 (https://www.dell.com/support/kbdoc/en-us/000502744/dsa-2026-387-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities), and because that advisory bundles multiple WMS vulnerabilities, schedule the full update rather than a partial mitigation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wyse Management Suite
View allRemote code execution affects Dell Wyse Management Suite in all versions prior to WMS 5.5 HF1, stemming from the applica
Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticat
Dell Wyse Management Suite versions prior to 5.5 suffer from improper access controls that allow authenticated remote at
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. Rated high sever
Unauthenticated remote code execution in Dell Wyse Management Suite (WMS) lets any remote attacker who can reach the man
Unauthenticated remote attackers can upload files of dangerous type to Dell Wyse Management Suite deployments running ve
Dell Wyse Management Suite versions prior to 5.2 contain an Absolute Path Traversal vulnerability (CWE-36) that allows u
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Rated high severity (CVS
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Querie
A information disclosure vulnerability in an Exposure of Sensitive Information (CVSS 7.5). High severity vulnerability r
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 allows
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today