CVE-2026-81236 is a high severity (CVSS 8.6) unrestricted file upload in Dell Wyse Management Suite before 2605.0.3.683. An unauthenticated attacker with remote access could potentially achieve remote execution. Update to 2605.0.3.683 or later, per Dell advisory DSA-2026-387, and restrict access to the console.
What's affected
- Product: Dell Wyse Management Suite (WMS).
- Affected: versions before 2605.0.3.683.
- Fixed: 2605.0.3.683 or later. Dell's page would not load for me, so confirm details in DSA-2026-387.
- Weakness: CWE-434, unrestricted upload of file with dangerous type.
- CVSS 8.6 (high), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. Not listed in CISA KEV.
How to check if you're exposed
Open the Wyse Management Suite console and read the version, then compare it with 2605.0.3.683. Also check how the management server is exposed. A WMS server that thin clients reach over the internet is more visible than one only on the corporate network.
Look at the server for unexpected new files in web accessible folders, and at web logs for upload requests from unfamiliar clients.
Write down what you find, with the owner, version and network exposure of each instance. After you patch, check again and record the fixed version, so the next advisory starts from a current inventory. You can also paste a dependency manifest into the free scan at gold.safeguard.sh/scan for any packaged components that sit alongside this product.
What to do now
- Check your WMS version.
- Update to 2605.0.3.683 or later, following DSA-2026-387.
- Restrict access to the console and device facing ports to the networks that need them.
- Check the server for unexpected files, and rotate admin credentials if you find any.
- Read DSA-2026-387 for the other issues fixed in the same release.
Why it matters
Unrestricted file upload means the server accepts a file whose type or location it should have refused. If the file can then be run by the server, it becomes code. Dell says an unauthenticated remote attacker could potentially reach remote execution.
Device management servers control many endpoints, so a flaw in one reaches far. The usual defence is to restrict types, store uploads outside the web root, and patch on a short cycle.
Quick check
Do I need to log in to exploit it?
Dell says an unauthenticated attacker with remote access could potentially exploit it.
Sources
Last reviewed: 19 October 2026.
