Summary
CVE-2026-41120 is a critical-severity vulnerability in Dell Wyse Management Suite (WMS), an on-premises enterprise thin-client management platform, affecting all versions prior to WMS 5.5 HF1. The flaw is classified as "Acceptance of Extraneous Untrusted Data With Trusted Data" and can be exploited by a remote, unauthenticated attacker to achieve Remote Code Execution (RCE) on the underlying server. With a CVSS v3.1 base score of 9.8, this vulnerability represents a full-impact risk to confidentiality, integrity, and availability of affected systems.
Technical details
- Root cause: The vulnerability stems from improper handling of untrusted data submitted alongside legitimate trusted data, causing the server to process attacker-controlled input as if it were trusted. This class of flaw enables attackers to inject or substitute malicious data into trusted processing pipelines.
- Trigger conditions: The vulnerability is remotely triggerable with no authentication required, no user interaction, and low attack complexity, as confirmed by the official CVSS:3.1 vector (PR:N, UI:N, AC:L). Note: although the NVD text description references "a low privileged attacker," the authoritative CVSS vector explicitly specifies PR:N (no privileges required).
- Attack vector: Network-accessible; Dell Wyse Management Suite exposes a web management interface (typically on HTTPS ports 443 or 8443) that is reachable over the internet in on-premises deployments.
- Impact: Successful exploitation results in full Remote Code Execution on the WMS server, with complete compromise of confidentiality, integrity, and availability (all rated High in the CVSS vector).
Affected software
- Dell Wyse Management Suite (On-Premises) — all versions prior to WMS 5.5 HF1
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate action — patch: Upgrade Dell Wyse Management Suite to version 5.5 HF1 or later. This is the vendor-confirmed fix for CVE-2026-41120.
- Network mitigation (if patching is not immediately possible): Restrict external network access to the WMS web interface (ports 443/8443) using firewall rules or network segmentation. Ensure the WMS management portal is not exposed directly to the public internet, and limit access to trusted administrative networks only.
- Verify your deployment does not appear in internet-facing asset inventories and review firewall rules governing access to WMS ports.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.