CVE-2026-23859

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23859", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-16T18:05:07.319Z", "datePublished": "2026-02-24T19:35:02.937Z", "dateUpdated": "2026-02-24T21:41:09.368Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Wyse Management Suite", "vendor": "Dell", "versions": [{"lessThan": "5.5", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2026-02-24T18:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass."}], "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-24T19:35:02.937Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T21:40:57.291575Z", "id": "CVE-2026-23859", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:41:09.368Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23859", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T21:40:57.291575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T21:41:02.359Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Wyse Management Suite", "versions": [{"status": "affected", "version": "N/A", "lessThan": "5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-24T18:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass.", "supportingMedia": [{"type": "text/html", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-24T19:35:02.937Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23859", "state": "PUBLISHED", "dateUpdated": "2026-02-24T21:41:09.368Z", "dateReserved": "2026-01-16T18:05:07.319Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-02-24T19:35:02.937Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Wyse Management Suite", "vendor": "Dell", "versions": [{"lessThan": "5.5", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:wyse_management_suite:*:*:*:*:*:*:*:*", "matchCriteriaId": "2785B726-7FD1-41C8-91F9-46100C01E215", "versionEndExcluding": "5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to Protection mechanism bypass."}, {"lang": "es", "value": "Dell Wyse Management Suite en versiones anteriores a WMS 5.5, contiene una vulnerabilidad de aplicaci\u00f3n del lado del cliente de la seguridad del lado del servidor. Un atacante con muchos privilegios y con acceso remoto podr\u00eda, potencialmente, explotar esta vulnerabilidad para eludir el mecanismo de protecci\u00f3n."}], "id": "CVE-2026-23859", "lastModified": "2026-06-17T10:22:12.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23859", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T21:40:57.291575Z", "version": "2.0.3"}}]}, "published": "2026-02-24T20:27:47.460", "references": [{"source": "security_alert@emc.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Wyse Management Suite", "source": "cna", "vendor": "Dell"}, "product": "wyse_management_suite", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-17T15:39:53.534208+00:00", "value": {"mitigation_remediation": ["Upgrade Dell Wyse Management Suite to version\u202f5.5 or later to receive the fix for the client\u2011side enforcement flaw.", "If upgrading is not immediately possible, restrict remote access to client machines and enforce strict access controls to limit the set of users who can obtain high\u2011privilege access.", "Continuously monitor client\u2011side activity for anomalies that could indicate an attempt to bypass security controls, and keep client operating systems and firmware up to date to reduce other attack vectors."], "summary": {"action": "Assess", "impact": "Privilege escalation via client\u2011side bypass"}, "threat_synthesis": {"affected_systems": "Dell Wyse Management Suite installations running any version prior to 5.5 are affected. The flaw resides in components that enforce security policies on the client based on server instructions, and applies to all such client instances within the suite.", "description_and_impact": "The vulnerability is a Client\u2011Side Enforcement of Server\u2011Side Security flaw that allows a high\u2011privileged attacker with remote access to bypass client\u2011side security controls, potentially compromising the integrity of the management environment. It is classified as CWE\u2011602, indicating inadequate enforcement of server\u2011side security policies by the client, which could enable unintended privilege escalation or unauthorized configuration changes. This weakness alone does not grant confidentiality loss but undermines the integrity and enforcement of protection mechanisms.", "risk_and_exploitability": "The CVSS score of 2.7 reflects a low overall risk, and the EPSS score of less than 1\u202f% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the KEV catalog. Nonetheless, if an attacker already has high\u2011privilege remote access to a client, they can exploit the flaw to bypass server\u2011defined protection mechanisms. The overall risk depends primarily on the attacker\u2019s pre\u2011existing access level, with no exploitation possible for unauthenticated users."}}}}, "created": "2026-02-25T11:35:35.759189+00:00", "title": "Client\u2011Side enforcement bypass in Dell Wyse Management Suite before v5.5", "updated": "2026-04-17T15:45:15.901522+00:00", "vendors": ["dell", "dell$PRODUCT$wyse_management_suite"]}