CVE-2026-81238 is a high severity (7.5) missing authentication flaw in Dell Wyse Management Suite before 2605.0.3.683. An unauthenticated attacker with network access could reach a critical function and cause unauthorized access. Dell fixed it in 2605.0.3.683 and the repository build 2605.0.3.119, so upgrade both.
What's affected
Dell's advisory DSA-2026-387 lists two affected components. Dell Wyse Management Suite (WMS) before 2605.0.3.683 is affected, and the fix is 2605.0.3.683 or later. Dell Wyse Management Suite Repository before 2605.0.3.119 is affected, and the fix is 2605.0.3.119 or later.
The advisory covers multiple vulnerabilities, and lists no workarounds. Dell shows a release date of 31 August 2026 and a revision date of 15 September 2026.
How to check if you're exposed
Find your WMS server and its repository server, then compare their versions to the fixed builds above. In the WMS console the version is shown in the product information. On the server itself, the installed programs list shows the build number.
Also check how the console is reachable. The record describes an unauthenticated attacker with network access, so a WMS console that is open to the internet or to a wide internal range deserves attention first.
What to do now
- Inventory every WMS server and every WMS Repository server, including test and lab copies.
- Upgrade WMS to 2605.0.3.683 or later and the Repository to 2605.0.3.119 or later, using the download links in Dell's advisory DSA-2026-387.
- Limit network access to the WMS console and repository to management networks until the upgrade is done.
- Review recent access and file activity on the server for anything you cannot explain.
- Subscribe to Dell security advisories so the next fix reaches you quickly.
Why it matters
The weakness is CWE-306, missing authentication for critical function. It means a function that should require a login can be called without one. The vector scores it as network reachable, low complexity, no privileges, no user interaction, with a high integrity impact and no confidentiality or availability impact.
A management console for thin clients is a good target because it sits in the middle of many endpoints. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and the advisory I read does not report exploitation. Treat it as a patch soon item, and do not expose the console more widely than you must.
Management consoles for endpoint fleets deserve more caution than their CVSS number suggests. A thin client management server holds configuration and policy for many devices, so integrity damage there spreads. The vector for this record shows integrity as the only impact, which is a useful hint. The risk is that someone changes what the console says, not that data leaks.
A practical way to reduce exposure while you schedule the upgrade is to check how the console is published. Many teams expose these servers so remote devices can check in. If that is you, ask whether devices can reach the console through a narrower path, and whether administrative pages need to be reachable from the same address as device check in. The advisory lists no workaround, so network limits are a stopgap and not a fix.
It also helps to treat the three Wyse records as one change request. CVE-2026-81239 and CVE-2026-81240 are upload flaws in the same advisory, and the same upgrade covers all three.
Quick check
Does the record say this flaw is exploited in the wild?
No. The record's KEV flag is false and Dell's advisory does not report exploitation. That can change, so patch on your normal urgent schedule.
Sources
Last reviewed: 19 October 2026.
