DELL Technologies has released security advisory DSA-2026-405 addressing four cross-site scripting (XSS) vulnerabilities in Wyse Management Suite (WMS). The most severe flaw, CVE-2026-82158, carries a CVSS base score of 9.0 and enables script injection via improper input neutralisation during web page generation. Dell notes that versions prior to 2609.0.0.155 are affected, and a low-privilege attacker with remote access could potentially exploit it, potentially impacting resources beyond the vulnerable component.
The other remote XSS flaws, CVE-2026-82159 and CVE-2026-82161, have scores of 8.8 and 6.8 respectively, with CVE-2026-82159 allowing remote exploitation without user interaction, and CVE-2026-82161 requiring user interaction for script injection.
A fourth issue, CVE-2026-82160, is a local XSS vulnerability with a CVSS score of 3.3 that could be exploited by a low-privilege attacker with local access, resulting in script injection and limited confidentiality impacts. Affected versions include all Wyse Management Suite builds prior to 2609.0.0.155; installations 2609.0.0.155 and later are not affected. Dell has released the patch in WMS version 2609.0.0.155, made available on 28 September 2026.
Administrators should upgrade to 2609.0.0.155 or later via the Dell support portal and restrict network and local console access to trusted personnel to mitigate risk. No public PoC or active exploitation in the wild has been confirmed at this time.