CVE-2026-41120: Dell Wyse Management Suite, versions prior to WMS 5

Synopsis

This is a remote code execution vulnerability in Dell Wyse Management Suite, affecting all versions prior to 5.5 HF1. The flaw is classified as acceptance of extraneous untrusted data with trusted data, meaning the application processes attacker-supplied input alongside trusted data without adequately separating or validating it. An unauthenticated attacker reachable over the network can exploit this to execute arbitrary code on the affected system. A patched-image rebuild at version 5.5 HF1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Wyse Management Suite service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials or session token are needed; the CVSS vector specifies PR:N, so the attack is available to any unauthenticated party who can reach the service.

• Victim interactionNot required

  No user action is required to trigger exploitation; the CVSS vector specifies UI:N, so the attacker completes the attack entirely on their own.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Wyse Management Suite process, gaining full control over the application runtime.
• The attacker reads any data the service can access, including managed endpoint credentials, device configurations, and stored administrative secrets (CVSS C:H).
• The attacker modifies or deletes persisted configuration data, enrollment records, and policy definitions for managed thin-client endpoints (CVSS I:H).
• The attacker crashes or otherwise disrupts the Wyse Management Suite service, preventing administrators from managing or patching connected endpoints (CVSS A:H).