CVE-2026-81240 is a high severity (8.6) unrestricted file upload flaw in Dell Wyse Management Suite before 2605.0.3.683. It is the second of two upload issues in the same Dell advisory. An unauthenticated network attacker could potentially reach remote execution. The fix is 2605.0.3.683, plus 2605.0.3.119 for the repository.
What's affected
Dell's advisory DSA-2026-387 lists two affected components. Dell Wyse Management Suite (WMS) before 2605.0.3.683 is affected, and the fix is 2605.0.3.683 or later. Dell Wyse Management Suite Repository before 2605.0.3.119 is affected, and the fix is 2605.0.3.119 or later.
The advisory covers multiple vulnerabilities, and lists no workarounds. Dell shows a release date of 31 August 2026 and a revision date of 15 September 2026.
How to check if you're exposed
Find your WMS server and its repository server, then compare their versions to the fixed builds above. In the WMS console the version is shown in the product information. On the server itself, the installed programs list shows the build number.
Also check how the console is reachable. The record describes an unauthenticated attacker with network access, so a WMS console that is open to the internet or to a wide internal range deserves attention first.
What to do now
- Inventory every WMS server and every WMS Repository server, including test and lab copies.
- Upgrade WMS to 2605.0.3.683 or later and the Repository to 2605.0.3.119 or later, using the download links in Dell's advisory DSA-2026-387.
- Limit network access to the WMS console and repository to management networks until the upgrade is done.
- Review recent access and file activity on the server for anything you cannot explain.
- Subscribe to Dell security advisories so the next fix reaches you quickly.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. The record gives the same description and the same 8.6 score as CVE-2026-81239. Dell does not publish separate details that tell the two apart in the pages I read.
Because the two share a fix, the practical advice is the same. Upgrade, and keep the console on a restricted network. The record is not flagged in CISA's KEV catalog.
Quick check
Why are there two CVEs with the same description?
Dell assigned two identifiers for two upload flaws in the same product. The public text does not separate them further, so treat the fixed builds as the remedy for both.
Sources
Last reviewed: 19 October 2026.
