Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Critical 9.0
CVE-2026-82158
Dell Wyse Management Suite — cross-site scripting.
Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability.
WeaknessCWE-79: Cross-site scripting
Published Updated Source NVD
CVSS 3.1
9.0
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.3%
Higher than 28% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Dell Wyse Management Suite, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs from Dell
17 more CVEs
9.8Dell PowerProtect Data Domain — buffer overflow.EPSS 0.8%9.6Dell PowerProtect Data Domain Management Center — SQL injection.EPSS 0.4%9.6Dell PowerProtect Data Domain Management Center — missing authorization.EPSS 0.3%9.8Dell PowerProtect Data Domain — Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release…EPSS 0.5%9.8Dell PowerProtect Data Domain — authentication bypass.EPSS 0.9%9.1Dell PowerProtect Data Domain Management Center — authentication bypass.EPSS 0.2%