Quick answers
- Is CVE-2026-41120 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41120 being exploited in the wild.
- How severe is CVE-2026-41120?
- Critical severity, with a CVSS score of 9.8, published 25 June 2026.
- Which products and versions are affected?
- Dell Wyse Management Suite Versions prior to 5.5 HF1.
- Is there a fix for CVE-2026-41120?
- A patch was published on 2026-05-08: Release date of remediated version 5.5 HF1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41120 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-41120?
- Check whether you run Dell Wyse Management Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Dell Wyse Management Suite (WMS) versions prior to 5.5 HF1 are vulnerable to an 'Acceptance of Extraneous Untrusted Data With Trusted Data' flaw (CWE-349). The vulnerability exists because the application fails to properly distinguish between trusted internal data and untrusted external input, allowing an attacker to inject malicious data that is subsequently processed as trusted. This can be exploited by a remote attacker with low privileges (or no privileges, as indicated by the CVSS vector PR:N) to achieve Remote Code Execution (RCE). The attack vector is network-based and requires no user interaction. Dell has released WMS version 5.5 HF1 to address this issue.
Affected products
- Dell Wyse Management Suite Versions prior to 5.5 HF1
Timeline
- 2026-05-08: patched: Release date of remediated version 5.5 HF1
- 2026-06-16: disclosed: Initial release of Dell Security Advisory DSA-2026-225
- 2026-06-25: advisory: NVD publication date