# Dell Wyse Management Suite Critical RCE Chain (CVE-2026-41120, CVE-2026-49506)

> Dell Wyse Management Suite (WMS) versions prior to 5.5 HF1 are vulnerable to two chainable flaws: CVE-2026-41120 (CVSS 9.8), an unauthenticated, no-user-interaction remote code execution stemming from acceptance of extraneous untrusted data alongside trusted data (CWE-349), and CVE-2026-49506 (CVSS 7.2), an authenticated path-traversal flaw (CWE-22) enabling file-path manipulation and potential RCE. Dell patched both in WMS 5.5 HF1, released May 8, 2026, and disclosed via DSA-2026-225 on June 16, 2026.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1204
- **ID:** TL-2026-1204
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41120, CVE-2026-49506

## Description

Dell Wyse Management Suite is the centralized, on-premises endpoint management platform used to provision, monitor, and remotely administer fleets of Dell Wyse thin clients across enterprise environments. Because WMS holds administrative control over thousands of managed endpoints, compromise of a single WMS instance can cascade into mass endpoint compromise and lateral movement across an organization's thin-client fleet.

CVE-2026-41120 is the more severe of the two flaws (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is classified as CWE-349 (Acceptance of Extraneous Untrusted Data With Trusted Data): the WMS server, when processing a request that legitimately contains trusted data, also accepts additional attacker-supplied data bundled alongside it and processes that untrusted payload as if it were trusted. This class of flaw is typically exploited by appending or interleaving malicious parameters, headers, or serialized fields into an otherwise-legitimate trusted request, causing the server-side handler to execute or act upon the injected content. The vulnerability requires no authentication, no privileges, and no user interaction, and is remotely reachable over the network — most WMS deployments expose the management web interface on TCP 443/8443. Because trust boundary enforcement fails at the point of data acceptance rather than during a later authorization check, an unauthenticated attacker can reach code paths intended only for the trusted internal data flow, resulting in full remote code execution with complete loss of confidentiality, integrity, and availability on the underlying WMS server (and by extension, over managed thin-client fleets).

CVE-2026-49506 (CVSS 3.1: 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is a path-traversal vulnerability (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) that requires high privileges to trigger. An authenticated, highly-privileged attacker can manipulate file-path input (e.g., via directory-traversal sequences such as ../ in upload, config, or file-management endpoints) to escape the intended restricted directory, read or write files outside the sanctioned path, and potentially achieve remote code execution by planting or overwriting server-side executable content. Dell's advisory notes this class of flaw is often chained with credential-theft or privilege-escalation techniques in real-world attacks, which lowers the practical barrier to exploitation despite the nominal high-privilege requirement — an attacker who first obtains low-privileged access (for example via CVE-2026-41120) could pivot into CVE-2026-49506 to entrench file-system-level persistence.

Both flaws were responsibly disclosed by security researcher Tien Phan and are documented in Dell Security Advisory DSA-2026-225 (initial release 2026-06-16). Dell remediated both issues in Wyse Management Suite 5.5 HF1, released 2026-05-08. As of this research, no public proof-of-concept exploit code, in-the-wild exploitation, or CISA KEV catalog listing has been identified for either CVE; risk assessment is therefore based on the vulnerability characteristics (unauthenticated, network-reachable, no user interaction) rather than confirmed active exploitation. Given the centralized administrative role WMS plays in Dell thin-client environments, unpatched internet-exposed or improperly segmented instances represent a high-value target for both opportunistic and targeted actors seeking to establish a foothold and pivot into managed endpoint fleets.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1072 Software Deployment Tools
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1485 Data Destruction
- T1595 Active Scanning
- T1588.005 Exploits

## Sources

- [Critical Dell Wyse Vulnerabilities Enables Remote Code Execution Attacks](https://cybersecuritynews.com/dell-wyse-vulnerabilities/)
- [DSA-2026-225: Security Update for Dell Wyse Management Suite (WMS) for Multiple Vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000465356/dsa-2026-225)
- [CVE-2026-41120 – Unauthenticated RCE – Dell Wyse Management Suite prior to 5.5 HF1](https://www.ionix.io/threat-center/cve-2026-41120/)
- [Dell Wyse Management Suite, versions prior to WMS 5.5 HF1 - GHSA-5mhj-93x4-vf9f](https://github.com/advisories/GHSA-5mhj-93x4-vf9f)
- [Dell Wyse Management Suite Flaws Let Remote Attackers Execute Code](https://cyberpress.org/dell-wyse-management-suite-flaws/)
- [Critical Dell Wyse Vulnerabilities Enable Remote Code Execution](https://securityboulevard.com/2026/06/critical-dell-wyse-vulnerabilities-enable-remote-code-execution/)
- [Critical Dell Wyse Management Suite Vulnerabilities Let Attackers Execute Remote Code](https://gbhackers.com/critical-dell-wyse-management-suite-vulnerabilities/)
- [Dell Wyse Management Suite Vulnerabilities Enable Remote Code Execution, Patch Now](https://vpncentral.com/dell-wyse-management-suite-vulnerabilities-enable-remote-code-execution-patch-now/)
- [CVE-2026-41120 Dell Wyse Management Suite acceptance of extraneous untrusted data with trusted data](https://vuldb.com/vuln/373835)
- [CVE-2026-49506 - Wyse Management Suite](https://o3.security/vulnerability/CVE-2026-49506)
- [Warning: Critical vulnerability in Dell Wyse, remote code execution for remote, low privileged attacker, Patch Immediately!](https://ccb.belgium.be/advisories/warning-critical-vulnerability-dell-wyse-remote-code-execution-remote-low-privileged)
- [Critical Dell Wyse Vulnerabilities Enable Remote Code Execution Attacks](https://www.cryptika.com/critical-dell-wyse-vulnerabilities-enable-remote-code-execution-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1204