Dell Wyse Management Suite Pre-Auth RCE Vulnerabilities CVE-2026-41120/49506 Advisory

Vulnerability Overview Vulnerability ID: CVE-2026-41120, CVE-2026-49506 Description: - CVE-2026-41120: In versions of Dell Wyse Management Suite prior to WMS 5.5 HF1, a vulnerability exists where the system accepts external untrusted data as trusted data. A low-privilege attacker with remote access may exploit this vulnerability to achieve remote code execution. - CVE-2026-49506: In versions of Dell Wyse Management Suite prior to WMS 5.5 HF1, a vulnerability exists due to improper restrictions on path names leading to restricted directories (path traversal). A high-privilege attacker with remote access may exploit this vulnerability to achieve remote code execution. Affected Products Product: Dell Wyse Management Suite (WMS) Affected Versions: Versions prior to 5.5 HF1 Remediation Fixed Version: 5.5 HF1 or later Release Date: August 5, 2026 Link: Dell Wyse Management Suite version 5.5 HF1 Driver Details Additional Information CVSS Base Score: - CVE-2026-41120: 9.8 - CVE-2026-49506: 7.2 CVSS Vector String: - CVE-2026-41120: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVE-2026-49506: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Credits Dell thanks Tien Phan for reporting these issues. Related Links Dell Security Advisories and Notices Dell Vulnerability Response Policy CVSS Scoring Guide Legal Disclaimer Read Dell Technologies Security Advisories to help avoid situations that may arise from the issues described herein. Dell Technologies distributes Security Advisories to communicate important security information to users of affected products. Dell Technologies assesses risk based on the diversity of installed systems and does not necessarily represent the actual risk to specific local installations and individual environments. All users are advised to determine the applicability of the information based on their own environments and actions taken. Information is provided "as is" without warranty of any kind. Dell Technologies expressly disclaims all warranties, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. In no event shall Dell Technologies, its affiliates, or suppliers be liable for any damages arising out of the use of this information or actions taken, including direct, indirect, incidental, consequential, loss of commercial profits, or special damages, even if Dell Technologies, its affiliates, or suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the above limitation may not apply to you. Affected Products Wyse Management Suite Provide Feedback Users can rate the article and provide additional information. Revision History Revision: 1.0 Date: 2026-06-16 Description: Initial release Summary This document primarily introduces two security vulnerabilities in Dell Wyse Management Suite (WMS), CVE-2026-41120 and CVE-2026-49506, detailing their impact, remediation plans, and related information. Users are advised to upgrade to version 5.5 HF1 or later as soon as possible to patch these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Dell Wyse Management Suite Pre-Auth RCE Vulnerabilities CVE-2026-41120/49506 Advisory