CVE-2026-22765: escalation in Wyse Management Suite

CVE-2026-22765 is a Missing Authorization vulnerability in Dell Wyse Management Suite, versions prior to 5.5. An attacker with low privilege and remote access can exploit it to achieve privilege escalation in the management system. Wyse Management Suite is critical in enterprise environments where it manages thin clients and desktops: its compromise exposes the entire infrastructure.

The CVSS is 8.8 (high). The vulnerability was published on February 24, 2026, but recent signals from GitHub repositories (dated November 6, 2026) indicate that public proof-of-concept code exists demonstrating an RCE chain combining CVE-2026-22765 and CVE-2026-22766. This suggests that practical risk has increased significantly after PoC availability.

IT teams and CISOs must immediately update Dell Wyse Management Suite to version 5.5 or later. In the meantime, it is essential to restrict remote access to the management suite, verify access logs to detect exploitation attempts, and monitor unusual behavior on connected Wyse clients. Priority is high given the CVSS 8.8 and the existence of public PoC.