Wyse Management Suite EUVD-2026-116376

Exploitation requires (1) a valid low-privileged authenticated account on the Dell Wyse Management Suite web management interface (PR:L - not anonymous/remote-unauthenticated), and (2) a victim user to interact with / render the attacker-injected content (UI:R). The payload is script injected into a web page that the application generates without proper input neutralization. Limiting factors: no exploitation is possible without an authenticated foothold, the attack cannot self-execute without a victim viewing the malicious page, and all affected deployments are versions prior to 2609.0.0.155 - updating to 2609.0.0.155 is the remediation stated by the vendor.

This is a moderate-severity, authenticated cross-site scripting flaw (CWE-79, CVSS 6.8) in Dell Wyse Management Suite, best characterized as a real but non-emergency issue to remediate on a routine cycle. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L shows network reach with low attack complexity, but two signals meaningfully constrain real-world risk: PR:L means the attacker must already hold a valid low-privileged account on the management console, and UI:R means a victim must interact with the attacker-injected content for the script to fire. There is no KEV listing and no public PoC or exploit reference in the supplied data, so exploitation status is: no public exploit identified at time of analysis - do not treat this as active exploitation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this input. The vendor-assigned impact of C:H with S:U is worth scrutiny: for a reflected/stored XSS whose payload executes in another user's browser, a scope-unchanged vector with High confidentiality is unusual, and typical XSS impact is lower and scope-changed - this is a severity-rating nuance to verify with Dell, not a contradiction in exploitability. The vuln.today decision label is 'this_month', consistent with a prioritized-but-not-urgent patch. Overall: a genuine issue requiring an authenticated foothold and user interaction - prioritize patching on a monthly cadence rather than as an incident.

A low-privileged user who already has an account on the Dell Wyse Management Suite web console injects a malicious script into a field that the application renders without proper neutralization. When another user - for example an administrator - subsequently views the affected page, the stored/reflected script executes in their authenticated browser session, enabling session hijacking or actions in that user's context. No public exploit code or PoC reference is present in the available data, and successful exploitation requires both valid low-privileged access and victim interaction.