{"id":"CVE-2026-82160","kind":"vulnerability","aliases":["CVE-2026-82160"],"related":[],"title":"Dell Wyse Management Suite: cross-site scripting flaw lets local users inject script","description":"Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.","summary":"Dell Wyse Management Suite versions before 2609.0.0.155 have a cross-site scripting flaw in their web pages. A low-privileged user with local access could inject script that runs in another user's browser session.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dell-wyse-management-suite","infrastructure","thin-clients"],"not_affected_if":["version-2609.0.0.155-or-later"],"how_to_check":"- Check the installed Dell Wyse Management Suite version against `2609.0.0.155`","fix":"- Dell Wyse Management Suite: move to `2609.0.0.155` or later","status":"open","published_at":"2026-11-03T21:17:44+00:00","first_seen_at":"2026-11-03T21:19:31+00:00","triaged_at":"2026-11-03T21:20:48+00:00","updated_at":"2026-11-03T21:20:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T21:20:48Z","model":"claude-haiku-5-5","output":{"fix":"- Dell Wyse Management Suite: move to `2609.0.0.155` or later","reach":"local","title":"Dell Wyse Management Suite: cross-site scripting flaw lets local users inject script","impact":"low","summary":"Dell Wyse Management Suite versions before 2609.0.0.155 have a cross-site scripting flaw in their web pages. A low-privileged user with local access could inject script that runs in another user's browser session.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["dell-wyse-management-suite","thin-clients"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Script runs in another user's session, possibly exposing their data.","analyst_note":"","how_to_check":"- Check the installed Dell Wyse Management Suite version against `2609.0.0.155`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["version-2609.0.0.155-or-later"],"who_is_affected":"Organizations running Dell Wyse Management Suite before 2609.0.0.155 are exposed, and the flaw needs a low-privileged account with local access. Sources do not say which deployment modes or configurations are affected, so teams should check their own installs against the version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00066,"input_tokens":4134,"output_tokens":494,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-82160':17A,20A '2609.0.0.155':36B,74C 'access':55B,96C 'anoth':62B 'attack':93C 'browser':65B 'client':29B 'contain':75C 'could':56B,97C 'cross':6A,40B,86C 'cross-sit':5A,39B,85C 'cve':15A,18A 'dell':1A,22B,30B,67C 'dell-wyse-management-suit':21B 'exploit':99C 'flaw':9A,43B 'generat':84C 'improp':77C 'infrastructur':26B 'inject':13A,57B,105C 'input':80C 'lead':102C 'let':10A 'local':11A,54B,95C 'low':50B,91C 'low-privileg':49B 'manag':3A,24B,32B,69C 'neutral':78C 'page':47B,83C 'potenti':98C 'prior':72C 'privileg':51B,92C 'run':60B 'script':8A,14A,42B,58B,88C,104C 'session':66B 'site':7A,41B,87C 'suit':4A,25B,33B,70C 'thin':28B 'thin-client':27B 'user':12A,52B,63B 'version':34B,71C 'vulner':89C,101C 'web':46B,82C 'wyse':2A,23B,31B,68C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell Wyse Management Suite before 2609.0.0.155 are exposed, and the flaw needs a low-privileged account with local access. Sources do not say which deployment modes or configurations are affected, so teams should check their own installs against the version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dellwysemanagementsuite","infrastructure","low","thinclients"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82160","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82160","severity":null,"published_at":"2026-11-03T21:17:44+00:00","modified_at":"2026-11-03T21:17:44+00:00","first_seen_at":"2026-11-03T21:19:31+00:00","fetched_at":"2026-11-03T21:19:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}