Wyse Management Suite EUVD-2026-116373

Requires a valid low-privileged authenticated account on the Dell Wyse Management Suite web interface with remote network access to it (CVSS PR:L). The flaw is script injection ('Cross-site Scripting') in web page generation, but the available sources do not name the specific feature, field, or page that is the injection point - the trigger is not described in the available sources. Realistic exploitation of XSS of this type typically also depends on a second user (often an administrator) rendering the injected content; the vendor marks UI:N, but this is unverified against mechanism. Limiting factors: attacker must first obtain a low-privileged WMS account, and exposure is confined to deployments running the WMS console at a version prior to 2609.0.0.155.

Signals are moderately consistent but not fully corroborated. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) describes a network-reachable, low-complexity flaw needing only low privileges and no user interaction. EPSS is not provided, the CVE is not in CISA KEV, and no public exploit is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week,' indicating prioritized-but-not-emergency remediation, which fits a high-CVSS issue lacking confirmed exploitation. One signal is internally inconsistent and should be flagged: a CWE-79 cross-site scripting bug carries a full C:H/I:H/A:H impact triad with UI:N and Scope:Unchanged - atypical for XSS, which usually requires a victim to render the payload (UI:R) and causes a scope change into the victim's browser with limited availability impact. Treat the 8.8 as the vendor's rating rather than independently validated mechanism; verify the injection point and real impact with Dell. Net: a real, worth-patching authenticated web vulnerability in a management console, but closer to a targeted insider/foothold-escalation issue than a mass-exploited internet threat given the required low-privileged account and absence of EPSS/KEV/POC evidence.

A low-privileged authenticated user of the Dell Wyse Management Suite web console injects malicious script into a field that is later rendered in another user's browser (typically a higher-privileged administrator), executing attacker-controlled JavaScript in that session. This could be used to steal session tokens or perform actions as the victim. No public exploit code is referenced, and the specific injection point is not described in the available sources.