Wyse Management Suite CVE-2026-82158

Exploitation requires a valid low-privileged authenticated account on the Dell Wyse Management Suite web console (PR:L) and user interaction (UI:R) - a higher-privileged user must view the page containing the injected script for impact to be realized. The affected deployment is any Wyse Management Suite instance prior to version 2609.0.0.155. The exact feature, field, or configuration carrying the unsanitized input is not described in the available sources, so the precise trigger is unverified. Limiting factors: attacker needs working credentials, cannot act purely unauthenticated, and must induce a victim to load the malicious content.

Signals point to elevated but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) describes a network-reachable, low-complexity flaw that requires authentication (PR:L) and victim interaction (UI:R), with a scope change (S:C) justifying the 9.0 score - the vendor rates confidentiality, integrity and availability impact all High, which is unusually aggressive for a CWE-79 cross-site scripting issue where impact is typically bounded by what script in a victim's session can do. The vuln.today Decision label is act_now, indicating the aggregator treats this as a priority. However, the input provides no EPSS probability, no CISA KEV listing, and no PoC or exploit reference, so there is no exploitation-probability or in-the-wild signal to corroborate that urgency - the act_now label appears driven by the high CVSS and scope change rather than observed exploitation. Net: a genuinely high-severity authenticated XSS in an administrative console (where a hijacked admin session is serious), but exploitation requires valid low-privilege credentials plus a tricked higher-privileged user, so it is a priority to patch rather than evidence of active mass exploitation. The All-High impact rating warrants verification against Dell's advisory DSA-2026-405.

A low-privileged authenticated user of the Dell Wyse Management Suite console injects a malicious script payload into a field that is later rendered without proper neutralization. When a higher-privileged operator or administrator views the affected page, the script executes in their authenticated browser session, enabling session/token theft or actions performed as that user. No public exploit code or PoC reference is provided in the available data.