EUVD-2026-78922
GHSA-4h4g-vf89-45jq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WMS console over network
-
ExploitIdentify unauthenticated critical function
-
ExecutionSend request bypassing auth
-
ImpactObtain unauthorized access to data/functions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to a Dell Wyse Management Suite console running a version prior to 2605.0.3.683; per CVSS PR:N/UI:N no authentication or user interaction is required. The limiting factor is exposure - WMS consoles are typically deployed inside enterprise management networks rather than internet-facing, so real-world reachability is often constrained to internal or VPN-accessible attackers. The description does not name the specific unauthenticated critical function, so it cannot be confirmed whether a non-default configuration or particular module is required. |
| Impact | Signals are internally consistent but point to a lower operational urgency than the 9.1 base score alone suggests. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact and no availability impact - appropriate for a CWE-306 Missing Authentication issue. However, exploitation-likelihood signals are weak: EPSS is only 0.25% (17th percentile), there is no CISA KEV listing, and no public exploit code was identified. SSVC-style framing therefore reads as exploitation=none, automatable=unproven (mechanism undisclosed), technical impact=partial-to-total. The gap between a critical base score and a low EPSS reflects that Wyse Management Suite is a niche enterprise management console rather than an internet-ubiquitous target, and that the Dell advisory discloses no exploitation mechanism. Note the description is thin: it states only 'Unauthorized access' without naming the specific critical function left unauthenticated, so the exact data or action exposed cannot be confirmed from available data - verify scope with the Dell advisory (DSA-2026-387). Prioritize patching where WMS consoles are network-exposed, but this is not evidence of widespread active exploitation. |
| Exploit ScenarioDerived | A remote attacker who can reach a Dell Wyse Management Suite console over the network sends requests to a critical function that fails to enforce authentication, obtaining unauthorized access to managed thin-client data or administrative functionality without any credentials. No public exploit code has been identified at time of analysis, and the specific unauthenticated endpoint is not disclosed in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 21, 2026
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) versions prior to 2605.0.3.683 lets a remote attacker reach protected functionality without supplying any credentials, resulting in unauthorized access with high confidentiality and integrity impact per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1). Affected deployments are WMS consoles (CPE cpe:2.3:a:dell:wyse_management_suite) that sit on management networks and expose the unauthenticated endpoint; because exploitation requires no authentication or user interaction, the practical barrier is network reachability rather than attacker capability. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.25% (17th percentile) indicates low predicted exploitation activity over the next 30 days, so operational urgency is driven primarily by how exposed a given console is.
Earlier versions of this analysis (1)
Missing authentication for a critical function in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 allows a remote, unauthenticated attacker to invoke a protected function without supplying credentials, resulting in unauthorized access to the management platform (CWE-306). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 7.5) indicates the flaw is exploitable with no authentication, no user interaction and low complexity, with integrity impact rated High and no confidentiality or availability impact. Dell has published advisory DSA-2026-387 with a fixed build (2605.0.3.683); no CISA KEV entry, EPSS score or public proof-of-concept was provided in the source data, so active exploitation is not confirmed.
RemediationAI
Vendor-released patch: upgrade Dell Wyse Management Suite to 2605.0.3.683 or later, as documented in Dell advisory DSA-2026-387 (https://www.dell.com/support/kbdoc/en-us/000502744/dsa-2026-387-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities); because CVE-2026-81238 is bundled with other fixes in that advisory, apply the full update rather than a partial one and verify the build number after upgrade. Until patching completes, the decisive compensating control is network reachability, since the vulnerable function cannot be authenticated client-side: block inbound access to the WMS console/administrative web ports (typically the WMS HTTPS console on 443/8443 and the device-management service ports) from anything other than trusted management subnets or an administrative VPN, and terminate any internet-facing or DMZ publication of the console - the trade-off is that remote administrators and branch-managed thin clients lose direct connectivity and may need proxy or jump-host access, and device enrollment/imaging traffic must be re-scoped carefully so legitimate thin clients are not blocked. Additional measures include placing the console on an isolated management VLAN with ACLs restricting east-west traffic, requiring administrative access through a jump host with MFA, and monitoring the console for unauthenticated requests to administrative endpoints or unexpected policy/configuration changes, which can act as an early detection signal given the absence of any public exploit identified at time of analysis. Be aware that authentication or hardening of the front-end does not remediate the underlying missing-authentication flaw, so the upgrade remains the only complete fix; disabling unused WMS modules or integrations can reduce the exposed surface but may break fleet management workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-306, Missing Authentication for Critical Function: an interface, endpoint, or administrative capability within Dell Wyse Management Suite performs a sensitive operation without first verifying the caller's identity. WMS is Dell's thin-client fleet management platform, responsible for device enrollment, imaging, configuration policy, application deployment, and remote command execution against Wyse thin clients, so an unauthenticated critical function inside it is a control-plane exposure rather than a data-only leak. The CPE string cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:*:*:*:* is version-agnostic in the feed, and the EUVD affected range narrows the vulnerable window to releases earlier than WMS 2605.0.3.683. Notably, the assessed vector scores confidentiality and integrity as High but availability as None (A:N), suggesting the exposed function permits reading and modifying management data or policy state without degrading service uptime, and the public description does not identify which specific critical function or module is unauthenticated, so it cannot be confirmed whether a non-default configuration is a prerequisite. The unauthenticated, no-interaction profile (PR:N/UI:N) means the exposure is reachable by any host that can route to the WMS console service.
Know when Wyse Management Suite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Missing authentication on a network-reachable critical function gives AV:N/AC:L/PR:N/UI:N; vendor-stated high confidentiality and integrity impact with no availability effect (C:H/I:H/A:N).
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
Executive ViewAI
Dell Wyse Management Suite (WMS) consoles - the centralized platform used to configure, patch, and manage the organization's thin-client and endpoint fleet - are affected by a critical CVSS 9.1 flaw that allows an unauthenticated attacker with network reach to access protected management functionality. Because exploitation requires no credentials or user interaction, any console reachable from an untrusted network segment effectively becomes an open door to the systems that control end-user devices across the enterprise. There is no public exploit identified at time of analysis and no vendor patch yet released, so leadership should treat risk as a function of network exposure and prioritize containment while awaiting a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict WMS console reachability to trusted administrative networks only (ACLs, firewall rules, VPN or zero-trust access); remove any internet-facing exposure; enforce an authenticating reverse proxy or WAF in front of the console; enable detailed logging and alerting on unauthenticated access attempts to management endpoints; segment management networks from user and guest networks; and open a tracked vendor case to obtain the fixed release and patch timeline. Apply vendor patch immediately once released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wyse Management Suite
View allUnrestricted file upload in Dell Wyse Management Suite prior to 2605.0.3.683 lets a remote attacker upload files of a da
Unauthenticated remote code execution affects Dell Wyse Management Suite deployments running any version prior to 2605.0
Unauthenticated remote code execution affects Dell Wyse Management Suite versions prior to 2605.0.3.683 through an unres
Remote code execution affects Dell Wyse Management Suite in all versions prior to WMS 5.5 HF1, stemming from the applica
Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticat
Dell Wyse Management Suite versions prior to 5.5 suffer from improper access controls that allow authenticated remote at
Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. Rated high sever
Dell Wyse Management Suite versions prior to 5.2 contain an Absolute Path Traversal vulnerability (CWE-36) that allows u
Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Rated high severity (CVS
Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Querie
A information disclosure vulnerability in an Exposure of Sensitive Information (CVSS 7.5). High severity vulnerability r
Dell Wyse Management Suite 3.6.1 and below contains Information Disclosure in Devices error pages. Rated high severity (
Exploit-DB