What’s Vulnerable › Vulnerabilities

CVE-2026-1226

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-11 · updated 2026-06-17
• Weakness: CWE-94

Description

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file.

Affected products

• Schneider Electric EcoStruxure Building Operation Webstation: from All 6.0.x versions prior through 6.0.4.7000 (CP5)
• Schneider Electric EcoStruxure Building Operation Workstation: from All 7.0.x versions prior through 7.0.2

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-02.pdf

Get alerted when CVE-2026-1226 or the next vulnerability affects your stack