CVE-2026-22766

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22766", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-09T18:05:08.764Z", "datePublished": "2026-02-24T19:28:14.566Z", "dateUpdated": "2026-03-20T19:43:58.535Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-20T19:43:58.535Z"}, "datePublic": "2026-02-24T18:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "affected": [{"vendor": "Dell", "product": "Wyse Management Suite", "versions": [{"status": "affected", "version": "0", "lessThan": "5.5*", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution."}]}], "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:02.336721Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:07.365Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T04:56:02.336721Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:54:15.803Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Wyse Management Suite", "versions": [{"status": "affected", "version": "0", "lessThan": "5.5*", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-24T18:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.", "supportingMedia": [{"type": "text/html", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-03-20T19:43:58.535Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22766", "state": "PUBLISHED", "dateUpdated": "2026-03-20T19:43:58.535Z", "dateReserved": "2026-01-09T18:05:08.764Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-02-24T19:28:14.566Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wyse Management Suite", "vendor": "Dell", "versions": [{"lessThan": "5.5*", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "2785B726-7FD1-41C8-91F9-46100C01E215", "versionEndExcluding": "5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution."}, {"lang": "es", "value": "Dell Wyse Management Suite en versiones anteriores a WMS 5.5, contiene una vulnerabilidad de Carga sin Restricciones de Archivo con Tipo Peligroso. Un atacante con muchos privilegios y con acceso remoto podr\u00eda, potencialmente, explotar esta vulnerabilidad, lo que llevar\u00eda a la ejecuci\u00f3n remota."}], "id": "CVE-2026-22766", "lastModified": "2026-06-17T10:20:23.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22766", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T04:56:02.336721Z", "version": "2.0.3"}}]}, "published": "2026-02-24T20:27:46.957", "references": [{"source": "security_alert@emc.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Wyse Management Suite", "source": "cna", "vendor": "Dell"}, "product": "wyse_management_suite", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-16T06:09:02.868589+00:00", "value": {"mitigation_remediation": ["Upgrade Dell Wyse Management Suite to version\u202f5.5 or later, which includes a fix for the unrestricted file upload flaw.", "If an upgrade cannot be performed immediately, disable or strictly restrict the file upload feature or enforce a whitelist of acceptable file types to prevent malicious uploads.", "Ensure that only trusted administrative accounts have remote access to the management console and enable multi\u2011factor authentication for those accounts to reduce the risk of privilege escalation."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects Dell Wyse Management Suite versions before 5.5. Systems running those versions are susceptible to the exploit regardless of network configuration, as the attack requires only a high\u2011privileged remote session to the management console.\n", "description_and_impact": "This vulnerability allows an attacker with high privileges to upload arbitrary files of dangerous types through the Dell Wyse Management Suite. The upload flaw can be leveraged to upload a malicious payload that the system will execute, resulting in remote code execution. The weakness maps to CWE-434, where the application fails to validate the type of uploaded files.\n", "risk_and_exploitability": "The CVSS score of 7.2 classifies this as high severity. The EPSS score is below 1\u202f%, indicating that while exploitability is low, it is not impossible. The vulnerability is not listed in the CISA KEV catalog, but remote execution remains a critical risk if the conditions are met. Attackers must first obtain elevated remote access; once achieved, the upload flaw can be invoked to execute arbitrary code.\n"}}}}, "created": "2026-02-25T11:35:37.459410+00:00", "title": "Unrestricted File Upload Allowing Remote Execution in Dell Wyse Management Suite before 5.5", "updated": "2026-04-16T06:15:26.913359+00:00", "vendors": ["dell", "dell$PRODUCT$wyse_management_suite"]}