CVE-2026-41120 Dell WMS Service Spawning Suspicious Child Process
Detects the spawning of suspicious child processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe) from processes related to the Dell Wyse Management Suite (WMS) service. This behavior is indicative of potential exploitation of CVE-2026-41120, a critical remote code execution vulnerability in the WMS application.
Microsoft Sentinel (KQL)
