CVE-2026-22765
Published: 24 February 2026
Summary
CVE-2026-22765 is a high-severity Missing Authorization (CWE-862) vulnerability in Dell Wyse Management Suite. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 31.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-24 (Access Control Decisions) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-22765 is a Missing Authorization vulnerability (CWE-862) affecting Dell Wyse Management Suite (WMS) in versions prior to 5.5. This flaw allows unauthorized access to certain functionalities due to inadequate permission checks, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity with significant impacts on confidentiality, integrity, and availability.
A low-privileged attacker with remote network access can exploit this vulnerability without user interaction or high complexity. Successful exploitation enables elevation of privileges, potentially granting the attacker higher-level access within the WMS environment and compromising the confidentiality, integrity, and availability of managed systems.
Dell has published security advisory DSA-2026-103 at https://www.dell.com/support/kbdoc/en-us/000429141/dsa-2026-103, which details mitigation steps and patch information for resolving the issue in affected versions. Security practitioners should review this advisory for upgrade guidance to WMS 5.5 or later.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8557
Vulnerability details
Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) directly enables remote privilege escalation from low-privileged access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 mandates enforcement of approved authorizations for logical access to resources, directly addressing the missing authorization checks that enable low-privileged attackers to escalate privileges in Dell WMS.
AC-24 requires systems to determine and authorize access to resources based on defined criteria, countering inadequate permission checks exploited in this vulnerability.
AC-6 enforces least privilege to restrict low-privileged users from accessing elevated functions, limiting the scope and impact of privilege escalation due to missing authorization.