Dell Wyse Management Vulnerabilities Enables Complete System Compromise
A security analysis has identified vulnerabilities in Dell Wyse Management Suite (WMS) On-Premises that can lead to a complete system compromise when exploited together.
A security analysis has identified vulnerabilities in Dell Wyse Management Suite (WMS) On-Premises that can lead to a complete system compromise when exploited together.
These vulnerabilities allow an unauthenticated attacker to bypass security controls and achieve remote code execution (RCE) on the management server .
CVE-2026-22765 (CVSS 8.8): A missing authorization flaw permits a low-privileged remote attacker to escalate privileges to full administrator level.
CVE-2026-22766 (CVSS 7.2): An unrestricted file upload vulnerability allows a high-privileged remote attacker to execute arbitrary code on the system.
Dell has addressed these vulnerabilities with the release of WMS version 5.5 on February 23, 2026. The issues affect on-premises deployments of both the free Standard and paid Pro editions.
The exploitation path involves device registration flaws, unprotected API endpoints, and path traversal bypasses, resulting in remote code execution.
The attack begins with device registration, where an attacker can register a rogue device by submitting an empty group token in the default configuration of the on-premises version.
These vulnerabilities allow an unauthenticated attacker to bypass security controls and achieve remote code execution (RCE) on the management server .
Although this places the device in a restricted quarantine group, it returns a device identifier and authentication code, providing initial interaction with the WMS API.
With a valid device signature, the attacker can exploit improperly exposed Active Directory (AD) import routes.
By calling the importADUserGroups and addRoleToADGroup API endpoints, a custom role group with administrative privileges is created.
The importADUsers endpoint is manipulated to provision a new administrator account linked to this role. Accessing this account requires overcoming an authentication barrier.
Attackers can exploit a logic flaw in the password reset function by importing the administrator with an empty Active Directory User Principal Name (UPN) , allowing a password reset request to an external email address.
In Pro environments with LDAP configured, an attacker can authenticate as the administrator using a compromised low-privileged domain user's credentials.
The final phase uses these administrative privileges to deploy a malicious JSP web shell.
Although the application implements filters against path traversal attacks , an administrator can reconfigure the local file repository settings to point to the Tomcat web root directory, bypassing file upload restrictions.
A JSP payload can then be uploaded, leading to unauthenticated remote code execution.
Dell's WMS version 5.5 addresses these logic flaws, breaking the exploitation chain.
System administrators managing Dell WMS On-Premises should update their infrastructure immediately to secure environments against these vulnerabilities.
Based on reporting by Cyber Security News.