# CVE-2026-49506: Dell Wyse Management Suite path traversal in restricted directory

Source: https://junglewise.ai/threats/cve-2026-49506-dell-wyse-management-suite-path-traversal-in-restricted-directory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-49506 · Severity: high · CVSS 7.2 · Published 2026-06-25

Dell Wyse Management Suite, a platform used to manage and configure thin client devices, is vulnerable to a security flaw that could allow an attacker to execute unauthorized commands. An attacker with high-level administrative privileges could bypass folder restrictions to access or modify sensitive system files. This could lead to a complete takeover of the management server, potentially impacting the security and availability of all managed devices.

Technologies: [Dell Wyse Management Suite](https://junglewise.ai/threats/technologies/wyse-management-suite). Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-49506 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49506 being exploited in the wild.

**How severe is CVE-2026-49506?** High severity, with a CVSS score of 7.2, published 25 June 2026.

**Which products and versions are affected?** Dell Wyse Management Suite Versions prior to 5.5 HF1.

**Is there a fix for CVE-2026-49506?** A patch was published on 2026-05-08: Remediated version 5.5 HF1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49506 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49506?** Check whether you run Dell Wyse Management Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Dell Wyse Management Suite (WMS) due to improper limitation of pathnames to restricted directories. A remote attacker with high privileges can exploit this flaw by submitting specially crafted input to access files outside of the intended directory. Successful exploitation can lead to Remote Code Execution (RCE) on the underlying operating system. The vulnerability is addressed in version 5.5 HF1 and later. Authentication is required (High privileges), but no user interaction is needed for exploitation.

## Affected products

- Dell Wyse Management Suite (WMS) Versions prior to 5.5 HF1

## Timeline

- 2026-05-08: patched: Remediated version 5.5 HF1 released
- 2026-06-16: advisory: Initial Dell security advisory (DSA-2026-225) published
- 2026-06-25: disclosed: CVE published to NVD

## References

- [https://www.dell.com/support/kbdoc/en-in/000465356/dsa-2026-225?msockid=3021cac2195069ed3194ddad186a68f9](https://www.dell.com/support/kbdoc/en-in/000465356/dsa-2026-225?msockid=3021cac2195069ed3194ddad186a68f9)

## Related threats

- [Dell Wyse Management Suite cross-site scripting](https://junglewise.ai/threats/cve-2026-82161-dell-wyse-management-suite-versions-prior-to-2609-0-0-155-contain)
- [Dell Wyse Management Suite cross-site scripting](https://junglewise.ai/threats/cve-2026-82159-dell-wyse-management-suite-versions-prior-to-2609-0-0-155-contain)
- [Dell Wyse Management Suite cross-site scripting](https://junglewise.ai/threats/cve-2026-82158-dell-wyse-management-suite-versions-prior-to-2609-0-0-155-contain)
- [Dell Wyse Management Suite unrestricted file upload with dangerous type](https://junglewise.ai/threats/cve-2026-81240-dell-wyse-management-suite-unrestricted-file-upload-with)
- [Dell Wyse Management Suite unrestricted file upload](https://junglewise.ai/threats/cve-2026-81239-dell-wyse-management-suite-unrestricted-file-upload)