CVE-2026-63700 is a high severity (CVSS 7.8) incorrect default permission flaw in Dell Wyse Management Suite (WMS) before 2605.0.2. A low privileged attacker with local access could potentially escalate privileges. Dell advisory DSA-2026-329 covers it, and the fixed version is 2605.0.2.
What's affected
The record says Dell Wyse Management Suite versions prior to 2605.0.2. The weakness is CWE-269 (improper privilege management). The description names an incorrect default permission, and says a low privileged attacker with local access could potentially exploit it.
The vector is local, high complexity, low privileges, no user interaction and a changed scope, with high impact on confidentiality, integrity and availability. The attacker needs a foothold on the host first, which is why the practical risk depends on who can log in to the management server.
The advisory is DSA-2026-329, which covers multiple WMS vulnerabilities, including CVE-2026-63701. Dell's support site requires a browser to view the advisory, so open the link in the sources and read the table of affected and remediated versions.
How to check if you're exposed
Find the installed WMS version on the management server.
Get-Package -Name "*Wyse Management*" | Select-Object Name, Version
Any version below 2605.0.2 is affected per the record. Also review who has local or remote desktop access to the server, and which accounts are members of local groups on it.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Find every WMS server and its version.
- Update to 2605.0.2 or later, following Dell's upgrade guidance, and take a backup first.
- Apply the fix for the sibling CVE-2026-63701 at the same time, since both are fixed by the same release per the record.
- Limit interactive logins to the WMS host to administrators who need them.
- Review file and folder permissions on the install directory after the upgrade.
Why it matters
Incorrect default permissions mean the product installs with access rules that are too loose. A low privileged local user can then change something that a higher privileged component later trusts. It is a quiet class of bug, since nothing is exploited remotely, yet it turns a small foothold into full control of the host.
A management server for thin clients is a high value host because of what it controls. The class is CWE-269. The record does not list the CVE as exploited in the wild.
Quick check
Do I need local access to exploit this?
Yes, the vector is local. Keeping untrusted users off the management host reduces exposure, but the update is the fix.
Sources
Last reviewed: 18 October 2026.
