CVE-2026-81239 is a high severity (8.6) unrestricted file upload flaw in Dell Wyse Management Suite before 2605.0.3.683. An unauthenticated attacker with network access could upload a dangerous file type and potentially reach remote execution. Dell fixed it in 2605.0.3.683 and the repository build 2605.0.3.119. Upgrade both components.
What's affected
Dell's advisory DSA-2026-387 lists two affected components. Dell Wyse Management Suite (WMS) before 2605.0.3.683 is affected, and the fix is 2605.0.3.683 or later. Dell Wyse Management Suite Repository before 2605.0.3.119 is affected, and the fix is 2605.0.3.119 or later.
The advisory covers multiple vulnerabilities, and lists no workarounds. Dell shows a release date of 31 August 2026 and a revision date of 15 September 2026.
How to check if you're exposed
Find your WMS server and its repository server, then compare their versions to the fixed builds above. In the WMS console the version is shown in the product information. On the server itself, the installed programs list shows the build number.
Also check how the console is reachable. The record describes an unauthenticated attacker with network access, so a WMS console that is open to the internet or to a wide internal range deserves attention first.
What to do now
- Inventory every WMS server and every WMS Repository server, including test and lab copies.
- Upgrade WMS to 2605.0.3.683 or later and the Repository to 2605.0.3.119 or later, using the download links in Dell's advisory DSA-2026-387.
- Limit network access to the WMS console and repository to management networks until the upgrade is done.
- Review recent access and file activity on the server for anything you cannot explain.
- Subscribe to Dell security advisories so the next fix reaches you quickly.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The server accepts a file it should have rejected, and what happens next depends on where the file lands and how the server treats it.
The score reflects network access, low complexity and no privileges, with a high integrity impact and low confidentiality and availability impact. Dell describes the outcome as remote execution. It is not on CISA's KEV list. A sibling issue, CVE-2026-81240, has the same class and score in the same advisory, so patching once covers both.
Quick check
Is this the same as CVE-2026-81240?
They are separate records in the same Dell advisory with the same weakness class and score. One upgrade to the fixed builds addresses both.
Sources
Last reviewed: 19 October 2026.
