RCE in Schneider Electric Ecostruxure Building Operation Webstation
CVE-2026-1226
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (2.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Schneider Electric Ecostruxure Building Operation Webstation — versions All 6.0.x versions prior to 6.0.4.7000 (CP5)
- Schneider Electric Ecostruxure Building Operation Workstation — versions All 7.0.x versions prior to 7.0.2