Improper Code Control Vulnerability in Schneider Electric's Graphic Processing Application
CVE-2026-1226

7HIGH

Key Information:

Vendor

Schneider Electric
Status
Ecostruxure Building Operation Workstation
Ecostruxure Building Operation Webstation
Vendor
CVE Published:
11 February 2026

What is CVE-2026-1226?

An improper control of code generation vulnerability exists within Schneider Electric's TGML graphics processing application. This flaw could allow the execution of untrusted or unintended code when maliciously crafted design content is processed, potentially compromising the integrity and security of the application.

Affected Version(s)

EcoStruxure Building Operation Webstation All 6.0.x versions prior to 6.0.4.7000 (CP5)

EcoStruxure Building Operation Workstation All 7.0.x versions prior to 7.0.2

References

https://download.schneider-electric.com/files?p_Doc_Ref=S...

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.