Wyse Management Suite EUVD-2026-116378

Exploitation requires the attacker to already have a low-privileged account AND local access to the Dell Wyse Management Suite instance (per CVSS AV:L and PR:L) running a version prior to 2609.0.0.155. The script-injection vector is local and authenticated, which substantially limits exposure: a remote, unauthenticated attacker cannot reach it from the supplied vector, and only confidentiality is affected (limited), with no integrity or availability impact. The exact feature, field, or page that accepts the unneutralized input is not described in the available sources, so the precise configuration prerequisite cannot be stated. The only complete fix per the vendor advisory is upgrading to 2609.0.0.155 or later.

This is a low-priority issue rather than a genuine emergency, and the signals are internally consistent rather than conflicting. The CVSS base score is only 3.3 (Low), driven by a vector that requires local access (AV:L), already-granted low privileges (PR:L), and yields only limited confidentiality impact (C:L) with no integrity or availability impact (I:N/A:N). The vuln.today decision label is 'monitor', the weakest urgency tier, which aligns with the low CVSS. There is no CISA KEV listing, no EPSS score was supplied, and no public exploit or PoC reference is present in the input. Combining these signals - low severity, local-only vector, pre-authenticated low-privilege requirement, limited single-system impact, and an explicit 'monitor' decision - the realistic risk is minor. The main caveat is that CWE-79 (XSS) normally implies a victim's browser executing injected script, which usually involves user interaction and can affect a different user/session, yet Dell's supplied vector lists UI:N and S:U; the trigger and the identity of the victim are not described in the available sources, so whether another operator's session is impacted cannot be confirmed from the data provided.

An attacker who already holds a low-privileged, locally accessible account on the Dell Wyse Management Suite environment injects crafted script into an input that is reflected or stored in a generated web page. When that page is rendered, the injected script executes in the web context, potentially exposing limited information. No public exploit or PoC is identified, and the exact injection point and trigger are not described in the available sources.