CVE-2026-66271

HighCVSS 7.2/10Last modified Aug 18, 2026

Description

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Aug 14, 2026
Last modified
Aug 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-662725.3Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unautCVE-2026-662737.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-662747.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issuCVE-2026-662756.5An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affectCVE-2026-662766.5An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handlingCVE-2026-662776.5It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excesCVE-2026-662797.2In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resultinCVE-2026-66286.3A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the componCVE-2026-662816.0In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop)CVE-2026-662826.0In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach itsCVE-2026-66297.3A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the CVE-2026-662966.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the
CVE-2026-66271: High severity, CVSS 7.2 | Vulnix