Dell Wyse Management Suite Critical RCE Chain (CVE-2026-41120, CVE-2026-49506)
Dell Wyse Management Suite Critical RCE Chain (TL-2026-1204), also tracked as DSA-2026-225, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-11. It has no confirmed attribution, affects Dell Wyse Management Suite, references 2 CVEs (CVE-2026-41120, CVE-2026-49506), maps to 18 MITRE ATT&CK techniques (T1005, T1021, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1204
- Threat ID
- TL-2026-1204
- Also known as
- DSA-2026-225
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise it, government administration, health, finance, education, retail, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Dell Wyse Management Suite (WMS) versions prior to 5.5 HF1 are vulnerable to two chainable flaws: CVE-2026-41120 (CVSS 9.8), an unauthenticated, no-user-interaction remote code execution stemming from acceptance of extraneous untrusted data alongside trusted data (CWE-349), and CVE-2026-49506 (CVSS 7.2), an authenticated path-traversal flaw (CWE-22) enabling file-path manipulation and potential RCE. Dell patched both in WMS 5.5 HF1, released May 8, 2026, and disclosed via DSA-2026-225 on June 16, 2026.
How Dell Wyse Management Suite Critical RCE Chain works
Dell Wyse Management Suite is the centralized, on-premises endpoint management platform used to provision, monitor, and remotely administer fleets of Dell Wyse thin clients across enterprise environments. Because WMS holds administrative control over thousands of managed endpoints, compromise of a single WMS instance can cascade into mass endpoint compromise and lateral movement across an organization's thin-client fleet.
CVE-2026-41120 is the more severe of the two flaws (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is classified as CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data): the WMS server, when processing a request that legitimately contains trusted data, also accepts additional attacker-supplied data bundled alongside it and processes that untrusted payload as if it were trusted. This class of flaw is typically exploited by appending or interleaving malicious parameters, headers, or serialized fields into an otherwise-legitimate trusted request, causing the server-side handler to execute or act upon the injected content. The vulnerability requires no authentication, no privileges, and no user interaction, and is remotely reachable over the network — most WMS deployments expose the management web interface on TCP 443/8443. Because trust boundary enforcement fails at the point of data acceptance rather than during a later authorization check, an unauthenticated attacker can reach code paths intended only for the trusted internal data flow, resulting in full remote code execution with complete loss of confidentiality, integrity, and availability on the underlying WMS server (and by extension, over managed thin-client fleets).
CVE-2026-49506 (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is a path-traversal vulnerability (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) that requires high privileges to trigger. An authenticated, highly-privileged attacker can manipulate file-path input (e.g., via directory-traversal sequences such as ../ in upload, config, or file-management endpoints) to escape the intended restricted directory, read or write files outside the sanctioned path, and potentially achieve remote code execution by planting or overwriting server-side executable content. Dell's advisory notes this class of flaw is often chained with credential-theft or privilege-escalation techniques in real-world attacks, which lowers the practical barrier to exploitation despite the nominal high-privilege requirement — an attacker who first obtains low-privileged access (for example via CVE-2026-41120) could pivot into CVE-2026-49506 to entrench file-system-level persistence.
Both flaws were responsibly disclosed by security researcher Tien Phan and are documented in Dell Security Advisory DSA-2026-225 (initial release 2026-06-16). Dell remediated both issues in Wyse Management Suite 5.5 HF1, released 2026-05-08. As of this research, no public proof-of-concept exploit code, in-the-wild exploitation, or CISA KEV catalog listing has been identified for either CVE; risk assessment is therefore based on the vulnerability characteristics (unauthenticated, network-reachable, no user interaction) rather than confirmed active exploitation. Given the centralized administrative role WMS plays in Dell thin-client environments, unpatched internet-exposed or improperly segmented instances represent a high-value target for both opportunistic and targeted actors seeking to establish a foothold and pivot into managed endpoint fleets.
MITRE ATT&CK techniques used in TL-2026-1204
Collection
Lateral Movement
T1021 Remote Services; T1072 Software Deployment Tools
Discovery
T1046 Network Service Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070 Indicator Removal; T1211 Exploitation for Stealth
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Impact
Persistence
T1505 Server Software Component; T1505.003 Web Shell
Credential Access
Resource Development
Reconnaissance
Affected products and versions in Dell Wyse Management Suite Critical RCE Chain
- Dell — Wyse Management Suite
Vulnerable versions: all versions prior to 5.5 HF1; 5.5 (without HF1 hotfix)
Fixed in: 5.5 HF1; later
Remediation for Dell Wyse Management Suite Critical RCE Chain
Patches
- Dell Wyse Management Suite 5.5 HF1 (released 2026-05-08) — resolves both CVE-2026-41120 and CVE-2026-49506
Immediate actions
- Upgrade Dell Wyse Management Suite to version 5.5 HF1 or later immediately
- Restrict network exposure of the WMS web management interface (TCP 443/8443) to trusted management networks only — never expose WMS directly to the internet
- Review WMS server and access logs for anomalous requests, unexpected parameters, or unauthorized file-path manipulation attempts predating the patch
- Rotate WMS administrative and service-account credentials as a precaution against undetected prior compromise
Workarounds
- If immediate patching is not possible, firewall the WMS management interface to only trusted administrative source IPs
- Disable or restrict any WMS API/file-upload endpoints not required for operational use until patched
Longer-term hardening
- Deploy EDR/host monitoring on the WMS server host to detect anomalous process execution or file writes originating from the WMS service account
- Implement network segmentation isolating endpoint-management infrastructure (WMS) from general user and internet-facing network segments
- Enforce least-privilege on WMS administrative accounts to reduce the blast radius of CVE-2026-49506-class privileged path-traversal abuse
- Establish a recurring patch-management cadence for Dell Wyse Management Suite and other centralized endpoint-management platforms given their high-value target profile
CVEs associated with Dell Wyse Management Suite Critical RCE Chain
CVE-2026-41120, CVE-2026-49506
Weaknesses (CWE) in Dell Wyse Management Suite Critical RCE Chain
CWE-349, CWE-22
Timeline of Dell Wyse Management Suite Critical RCE Chain
- Dell releases Wyse Management Suite 5.5 HF1, remediating CVE-2026-41120 and CVE-2026-49506.
- Cyber Security News and CyberPress publish initial reporting on the Dell Wyse Management Suite vulnerabilities.
- Dell publishes Security Advisory DSA-2026-225 disclosing both vulnerabilities, crediting researcher Tien Phan.
- Security Boulevard, GBHackers, and Cryptika publish follow-on technical coverage of the RCE chain.
- VPNCentral publishes patch-now guidance for affected Wyse Management Suite administrators.
- Belgium's CCB (Centre for Cybersecurity Belgium) issues a national warning advisory for the unauthenticated RCE risk.
- CVE-2026-49506 is published to the National Vulnerability Database with CWE-22 classification and CVSS 3.1 vector 7.2 (HIGH), sourced from Dell.
- GitHub Advisory Database publishes GHSA-5mhj-93x4-vf9f documenting CVE-2026-41120, listing an EPSS exploitation-probability score of 0.255% (17th percentile).
- CVE-2026-41120 is published to the National Vulnerability Database with CWE-349 classification and CVSS 3.1 vector.
- NVD entry for CVE-2026-41120 last modified.
Sources cited for Dell Wyse Management Suite Critical RCE Chain
- Critical Dell Wyse Vulnerabilities Enables Remote Code Execution Attacks
- DSA-2026-225: Security Update for Dell Wyse Management Suite (WMS) for Multiple Vulnerabilities
- CVE-2026-41120 – Unauthenticated RCE – Dell Wyse Management Suite prior to 5.5 HF1
- Dell Wyse Management Suite, versions prior to WMS 5.5 HF1 - GHSA-5mhj-93x4-vf9f
- Dell Wyse Management Suite Flaws Let Remote Attackers Execute Code
- Critical Dell Wyse Vulnerabilities Enable Remote Code Execution
- Critical Dell Wyse Management Suite Vulnerabilities Let Attackers Execute Remote Code
- Dell Wyse Management Suite Vulnerabilities Enable Remote Code Execution, Patch Now
- CVE-2026-41120 Dell Wyse Management Suite acceptance of extraneous untrusted data with trusted data
- CVE-2026-49506 - Wyse Management Suite
- Warning: Critical vulnerability in Dell Wyse, remote code execution for remote, low privileged attacker, Patch Immediately!
- Critical Dell Wyse Vulnerabilities Enable Remote Code Execution Attacks
Threats related to Dell Wyse Management Suite Critical RCE Chain
- Dell PowerProtect Data Domain Multiple Vulnerabilities: Improper Authentication (CVE-2026-53483) and Path Traversal (CVE-2026-53481) Allow Full Remote System Access
- Critical Ubuntu Pro Client Vulnerability Enables Root Code Execution via Contract Server Spoofing (CVE-2026-11386)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)
- CISA KEV (2026-05-21): CVE-2025-34291 Langflow CORS Token Hijack-to-RCE & CVE-2026-34926 Trend Micro Apex One On-Premise Directory Traversal
- Pwn2Own Berlin 2026 Day Two: Microsoft Exchange RCE-as-SYSTEM Chain and 14 Other Zero-Days Disclosed
Detection coverage for TL-2026-1204
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1204 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.