Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-82158 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-03 |
| Vendor | Dell |
| Product | Wyse Management Suite |
| CVSS Score | 9 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Dell Wyse Management Suite (WMS) versions prior to 2609.0.0.155 contain an Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability. A low-privileged attacker with remote access could inject script that runs in another console user’s browser — for example an administrator managing the thin-client fleet.
Required Actions
Update Dell Wyse Management Suite to version 2609.0.0.155 or later (Dell advisory DSA-2026-405). Until you update, restrict access to the WMS console to the management network and review low-privileged accounts that can reach it.
Who Is Affected?
The vulnerability affects Dell Wyse Management Suite by Dell — the console for managing Dell Wyse thin clients and VDI endpoints. Check whether your organization manages Wyse thin clients with WMS older than 2609.0.0.155.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
