A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Six years. Gartner® Magic Quadrant™ Leader.Find Out Why
Experiencing a Breach?Blog
Get StartedContact Us
SentinelOne
  • Platform
    Platform Overview
    • Singularity Platform
      Welcome to Integrated Enterprise Security
    • AI for Security
      Leading the Way in AI-Powered Security Solutions
    • Securing AI
      Accelerate AI Adoption with Secure AI Tools, Apps, and Agents.
    • How It Works
      The Singularity XDR Difference
    • Singularity Marketplace
      One-Click Integrations to Unlock the Power of XDR
    • Pricing & Packaging
      Comparisons and Guidance at a Glance
    Data & AI
    • Purple AI
      Accelerate SecOps with Generative AI
    • Singularity Hyperautomation
      Easily Automate Security Processes
    • AI-SIEM
      The AI SIEM for the Autonomous SOC
    • AI Data Pipelines
      Security Data Pipeline for AI SIEM and Data Optimization
    • Singularity Data Lake
      AI-Powered, Unified Data Lake
    • Singularity Data Lake for Log Analytics
      Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
    Endpoint Security
    • Singularity Endpoint
      Autonomous Prevention, Detection, and Response
    • Singularity XDR
      Native & Open Protection, Detection, and Response
    • Singularity RemoteOps Forensics
      Orchestrate Forensics at Scale
    • Singularity Threat Intelligence
      Comprehensive Adversary Intelligence
    • Singularity Vulnerability Management
      Application & OS Vulnerability Management
    • Singularity Identity
      Identity Threat Detection and Response
    Cloud Security
    • Singularity Cloud Security
      Block Attacks with an AI-Powered CNAPP
    • Singularity Cloud Native Security
      Secure Cloud and Development Resources
    • Singularity Cloud Workload Security
      Real-Time Cloud Workload Protection Platform
    • Singularity Cloud Data Security
      AI-Powered Threat Detection for Cloud Storage
    • Singularity Cloud Security Posture Management
      Detect and Remediate Cloud Misconfigurations
    Securing AI
    • Prompt Security
      Secure AI Tools Across Your Enterprise
  • Why SentinelOne?
    Why SentinelOne?
    • Why SentinelOne?
      Cybersecurity Built for What’s Next
    • Our Customers
      Trusted by the World’s Leading Enterprises
    • Industry Recognition
      Tested and Proven by the Experts
    • About Us
      The Industry Leader in Autonomous Cybersecurity
    Compare SentinelOne
    • Arctic Wolf
    • Broadcom
    • CrowdStrike
    • Cybereason
    • Microsoft
    • Palo Alto Networks
    • Sophos
    • Splunk
    • Trellix
    • Trend Micro
    • Wiz
    Verticals
    • Energy
    • Federal Government
    • Finance
    • Healthcare
    • Higher Education
    • K-12 Education
    • Manufacturing
    • Retail
    • State and Local Government
  • Services
    Managed Services
    • Managed Services Overview
      Wayfinder Threat Detection & Response
    • Threat Hunting
      World-Class Expertise and Threat Intelligence
    • Managed Detection & Response
      24/7/365 Expert MDR Across Your Entire Environment
    • Incident Readiness & Response
      DFIR, Breach Readiness, & Compromise Assessments
    Support, Deployment, & Health
    • Technical Account Management
      Customer Success with Personalized Service
    • SentinelOne GO
      Guided Onboarding & Deployment Advisory
    • SentinelOne University
      Live and On-Demand Training
    • Services Overview
      Comprehensive Solutions for Seamless Security Operations
    • SentinelOne Community
      Community Login
  • Partners
    Our Network
    • MSSP Partners
      Succeed Faster with SentinelOne
    • Singularity Marketplace
      Extend the Power of S1 Technology
    • Cyber Risk Partners
      Enlist Pro Response and Advisory Teams
    • Technology Alliances
      Integrated, Enterprise-Scale Solutions
    • SentinelOne for AWS
      Hosted in AWS Regions Around the World
    • Channel Partners
      Deliver the Right Solutions, Together
    • SentinelOne for Google Cloud
      Unified, Autonomous Security Giving Defenders the Advantage at Global Scale
    • Partner Locator
      Your Go-to Source for Our Top Partners in Your Region
    Partner Portal→
  • Resources
    Resource Center
    • Case Studies
    • Data Sheets
    • eBooks
    • Reports
    • Videos
    • Webinars
    • Whitepapers
    • Events
    View All Resources→
    Blog
    • Feature Spotlight
    • For CISO/CIO
    • From the Front Lines
    • Identity
    • Cloud
    • macOS
    • SentinelOne Blog
    Blog→
    Tech Resources
    • SentinelLABS
    • Ransomware Anthology
    • Cybersecurity 101
  • About
    About SentinelOne
    • About SentinelOne
      The Industry Leader in Cybersecurity
    • Investor Relations
      Financial Information & Events
    • SentinelLABS
      Threat Research for the Modern Threat Hunter
    • Careers
      The Latest Job Opportunities
    • Press & News
      Company Announcements
    • Cybersecurity Blog
      The Latest Cybersecurity Threats, News, & More
    • FAQ
      Get Answers to Our Most Frequently Asked Questions
    • DataSet
      The Live Data Platform
    • S Foundation
      Securing a Safer Future for All
    • S Ventures
      Investing in the Next Generation of Security, Data and AI
  • Pricing
Get StartedContact Us
CVE Vulnerability Database
Vulnerability Database/CVE-2025-36574

CVE-2025-36574: Dell Wyse Path Traversal Vulnerability

CVE-2025-36574 is an absolute path traversal vulnerability in Dell Wyse Management Suite that allows unauthenticated attackers to access sensitive data. This article covers technical details, affected versions, and steps to secure your system.

Updated: May 15, 2026

CVE-2025-36574 Overview

CVE-2025-36574 is an Absolute Path Traversal vulnerability [CWE-36] affecting Dell Wyse Management Suite (WMS) versions prior to 5.2. The flaw allows an unauthenticated remote attacker to access files outside the application's intended directory by supplying absolute file paths in requests. Successful exploitation can result in information disclosure and unauthorized access to sensitive resources managed by the WMS server.

Dell published security advisory DSA-2025-226 covering this issue, and the fix is included in Wyse Management Suite 5.2.

Critical Impact

An unauthenticated network attacker can read arbitrary files on the WMS server, exposing configuration data, credentials, and management metadata used to control Dell Wyse thin client fleets.

Affected Products

  • Dell Wyse Management Suite versions prior to 5.2
  • Deployments exposing the WMS web interface over the network
  • Environments managing Dell Wyse thin clients through centralized WMS infrastructure

Discovery Timeline

  • 2025-06-10 - CVE-2025-36574 published to NVD
  • 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-36574

Vulnerability Analysis

The vulnerability stems from improper handling of user-supplied path input in Dell Wyse Management Suite. The application accepts absolute file paths from remote callers without validating that the resolved path remains within an authorized directory. An attacker can submit a fully qualified path and force the server to read its contents.

The issue is exploitable over the network without authentication or user interaction. Attack complexity is low, and the resulting impact targets confidentiality of files accessible to the WMS service account. Integrity impact is limited, and availability is not directly affected.

Dell Wyse Management Suite is the centralized management plane for Wyse thin clients. Files reachable through this flaw can include configuration data, certificates, tokens, and operational artifacts used to provision endpoints. Disclosure of these assets can support follow-on attacks against the broader thin client estate.

Root Cause

The root cause is missing canonicalization and validation of absolute path input [CWE-36]. The application trusts caller-supplied paths and resolves them directly against the filesystem instead of constraining requests to a designated content directory.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the WMS service containing an absolute path pointing to a target file. The server resolves and returns the file contents. No credentials, session, or user interaction are required.

No verified public proof-of-concept exploit is available at the time of writing. See the Dell Security Advisory DSA-2025-226 for vendor technical guidance.

Detection Methods for CVE-2025-36574

Indicators of Compromise

  • HTTP requests to WMS endpoints containing absolute filesystem paths such as C:\ or /etc/ in query parameters, headers, or POST bodies
  • Unexpected outbound responses from the WMS server containing configuration files, certificates, or credential material
  • Access log entries showing file reads outside the WMS application directory by the service account

Detection Strategies

  • Inspect WMS web server access logs for path traversal patterns and absolute path indicators in request parameters
  • Deploy web application firewall rules that block absolute path syntax in requests targeting WMS endpoints
  • Correlate WMS file access activity with the originating request to identify reads of files outside the expected application scope

Monitoring Recommendations

  • Forward WMS application and web server logs to a centralized logging or SIEM platform for retention and analysis
  • Alert on unauthenticated requests that produce large or sensitive file responses from the WMS service
  • Monitor for anomalous network traffic from WMS hosts that may indicate post-exploitation activity against managed thin clients

How to Mitigate CVE-2025-36574

Immediate Actions Required

  • Upgrade Dell Wyse Management Suite to version 5.2 or later as directed in Dell Security Advisory DSA-2025-226
  • Restrict network access to the WMS management interface to trusted administrative networks only
  • Rotate any credentials, API tokens, or certificates that may have resided on the WMS host prior to patching

Patch Information

Dell has released Wyse Management Suite 5.2, which remediates the absolute path traversal flaw. Administrators should consult Dell Security Advisory DSA-2025-226 for the specific build, upgrade procedure, and verification steps. Apply the update on all on-premises WMS servers.

Workarounds

  • Place the WMS server behind a reverse proxy or WAF that blocks requests containing absolute path patterns until patching is complete
  • Limit inbound exposure of WMS to administrative VLANs or VPN-only access
  • Review filesystem permissions on the WMS host so that the service account cannot read sensitive files outside its required scope
bash
# Example WAF rule concept to block absolute path patterns in WMS requests
# Adjust to your WAF syntax and test before enforcement
SecRule REQUEST_URI|ARGS|REQUEST_HEADERS "@rx (?:^|[?&=/])(?:[A-Za-z]:[\\/]|/(?:etc|var|root|home)/)" \
  "id:1003657,phase:2,deny,status:403,log,msg:'Possible CVE-2025-36574 path traversal attempt against WMS'"

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

  • Vulnerability Details
  • TypePath Traversal

  • Vendor/TechDell Wyse Management Suite

  • SeverityHIGH

  • CVSS Score8.2

  • EPSS Probability2.62%

  • Known ExploitedNo
  • CVSS Vector
  • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
  • Impact Assessment
  • ConfidentialityLow
  • IntegrityNone
  • AvailabilityNone
  • CWE References
  • CWE-36
  • Vendor Resources
  • Dell Security Advisory DSA-2025-226
  • Related CVEs
  • CVE-2026-23859: Dell Wyse Management Suite Auth Bypass

  • CVE-2026-23858: Dell Wyse Management Suite XSS Vulnerability

  • CVE-2026-22766: Dell Wyse Management Suite RCE Vulnerability

  • CVE-2026-22765: Dell Wyse Management Suite Escalation Bug
Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne
  • Get Started
  • Get a Demo
  • Product Tour
  • Why SentinelOne
  • Pricing & Packaging
  • FAQ
  • Contact
  • Contact Us
  • Customer Support
  • SentinelOne Status
  • Language
  • Platform
  • Singularity Platform
  • Singularity Endpoint
  • Singularity Cloud
  • Singularity AI-SIEM
  • Singularity Identity
  • Singularity Marketplace
  • Purple AI
  • Services
  • Wayfinder TDR
  • SentinelOne GO
  • Technical Account Management
  • Support Services
  • Verticals
  • Energy
  • Federal Government
  • Finance
  • Healthcare
  • Higher Education
  • K-12 Education
  • Manufacturing
  • Retail
  • State and Local Government
  • Cybersecurity for SMB
  • Resources
  • Blog
  • Labs
  • Case Studies
  • Videos
  • Product Tours
  • Events
  • Cybersecurity 101
  • eBooks
  • Webinars
  • Whitepapers
  • Press
  • News
  • Ransomware Anthology
  • Company
  • About Us
  • Our Customers
  • Careers
  • Partners
  • Legal & Compliance
  • Security & Compliance
  • Investor Relations
  • S Foundation
  • S Ventures

©2026 SentinelOne, All Rights Reserved.

Privacy Notice Terms of Use

English