XXE in Schneider Electric Ecostruxure Building Operation Webstation
CVE-2026-1227
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation.
Vulnerability class: XXE (XML External Entity)
Published · last modified .
EPSS exploit prediction
EPSS: 0.001 (1.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 1st percentile — 1.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: +0.000
Affected products
- Schneider Electric Ecostruxure Building Operation Webstation — versions All 6.x versions prior to 6.0.4.14001 (CP10)
- Schneider Electric Ecostruxure Building Operation Workstation — versions All 7.0.x versions prior to 7.0.3.2000 (CP1)