Is CVE-2026-49506 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49506 being exploited in the wild.

How severe is CVE-2026-49506?

High severity, with a CVSS score of 7.2, published 25 June 2026.

Which products and versions are affected?

Dell Wyse Management Suite Versions prior to 5.5 HF1.

Is there a fix for CVE-2026-49506?

A patch was published on 2026-05-08: Remediated version 5.5 HF1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49506 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49506?

Check whether you run Dell Wyse Management Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49506: Dell Wyse Management Suite path traversal in restricted directory

CVE-2026-49506 · Severity: high · CVSS 7.2 · Published 2026-06-25

Dell Wyse Management Suite, a platform used to manage and configure thin client devices, is vulnerable to a security flaw that could allow an attacker to execute unauthorized commands. An attacker with high-level administrative privileges could bypass folder restrictions to access or modify sensitive system files. This could lead to a complete takeover of the management server, potentially impacting the security and availability of all managed devices.

Technologies: Dell Wyse Management Suite. Vendors: Dell.

Quick answers

Is CVE-2026-49506 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49506 being exploited in the wild.
How severe is CVE-2026-49506?: High severity, with a CVSS score of 7.2, published 25 June 2026.
Which products and versions are affected?: Dell Wyse Management Suite Versions prior to 5.5 HF1.
Is there a fix for CVE-2026-49506?: A patch was published on 2026-05-08: Remediated version 5.5 HF1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49506 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49506?: Check whether you run Dell Wyse Management Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in Dell Wyse Management Suite (WMS) due to improper limitation of pathnames to restricted directories. A remote attacker with high privileges can exploit this flaw by submitting specially crafted input to access files outside of the intended directory. Successful exploitation can lead to Remote Code Execution (RCE) on the underlying operating system. The vulnerability is addressed in version 5.5 HF1 and later. Authentication is required (High privileges), but no user interaction is needed for exploitation.

Affected products

Dell Wyse Management Suite (WMS) Versions prior to 5.5 HF1

Timeline

2026-05-08: patched: Remediated version 5.5 HF1 released
2026-06-16: advisory: Initial Dell security advisory (DSA-2026-225) published
2026-06-25: disclosed: CVE published to NVD

References

https://www.dell.com/support/kbdoc/en-in/000465356/dsa-2026-225?msockid=3021cac2195069ed3194ddad186a68f9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.