Dell Wyse Management Flaws Could Lead to Full System Compromise

Security researcher Aleksandr Zhurnakov from PT Security has identified a critical exploit chain in Dell Wyse Management Suite that enables unauthenticated remote code execution. This vulnerability affects the On-Premises version of the software, specifically impacting both the Standard and Pro editions.

The exploitation involves two newly disclosed vulnerabilities that can lead to a complete system compromise:

CVE-2026-22765 (CVSS 8.8) : This flaw permits privilege escalation by a low-privileged remote attacker. CVE-2026-22766 (CVSS 7.2) : This vulnerability allows remote code execution by a high-privileged remote attacker. Affected Products : Dell Wyse Management Suite (On-Premises). Fixed Version : Dell Wyse Management Suite version 5.5.

The exploit is initiated during the device registration process. In the default configuration of the on-premises software, an unauthenticated user can register a new device using an empty group token. This device is placed into a quarantine group, and although quarantined devices should not have privileges, they still receive valid authentication tokens. Attackers can utilize these tokens to interact with the system's application programming interfaces (APIs).

With access established, attackers exploit hidden logic flaws in the Active Directory user import functions. Even in the Standard edition, where Active Directory features are officially disabled, the APIs remain active. Attackers use these interfaces to create a new administrator role group and assign it to a newly imported user account.

Due to the auto-generated password for the new administrator account, attackers must find a way to log in. They bypass login restrictions by manipulating the password reset feature. By leaving specific user properties empty, the system fails to recognize the account as an Active Directory user, allowing the attacker to trigger a password reset and send the new credentials to an external email address.

In Pro environments, attackers can map the account to a compromised domain user and log in directly. Subsequently, the attacker uses their new administrator access to upload a malicious script, changing the local file repository path to point directly to the Tomcat web root folder.

After forcing a system restart to clear the memory cache, the attacker uploads a JavaServer Pages web shell. This bypasses typical file security filters and grants full remote code execution on the server.

Administrators are advised to update systems immediately to mitigate these vulnerabilities. Dell has addressed these issues in Wyse Management Suite version 5.5, as documented in advisory DSA-2026-103.

Based on reporting by GBHackers.