{"id":"CVE-2026-82158","published":"2026-11-03T21:17:43.823","lastModified":"2026-11-03T22:19:49.740","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506515/dsa-2026-405-security-update-for-dell-wyse-management-suite-wms-for-multiple-vulnerabilities","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A cross-site scripting (XSS) flaw in Dell Wyse Management Suite versions before 2609.0.0.155 allows low-privileged remote attackers to inject malicious scripts via unsanitized user input into web pages, enabling session hijacking or credential theft.","exploitability":"Exploitation requires a low-privileged attacker with remote access and user interaction (e.g., tricking a victim into clicking a crafted link), making it moderately difficult but feasible in insider or compromised-account scenarios.","blast_radius":"Successful exploitation could lead to full compromise of the affected web application’s users, including unauthorized administrative actions, data exfiltration, or lateral movement within the management environment.","remediation":"Upgrade Dell Wyse Management Suite to version 2609.0.0.155 or later, as this is the fixed version explicitly stated in the CVE description.","detection":"Defenders should monitor web access logs for unexpected script payloads (e.g., <script>, javascript:) in query parameters, POST bodies, or headers sent to management suite endpoints, especially from low-privileged accounts; anomalous outbound requests to external domains from the management interface may also indicate successful exploitation.","tags":["xss","web","input-validation","session-hijacking","low-privilege"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:55:58.462Z"}}