Stored Cross-Site Scripting Vulnerability in Microchip's TimePictra Platform
CVE-2026-8333

9.4CRITICAL

Key Information:

Vendor

Microchip

Status
Timepictra
Vendor
CVE Published:
12 November 2026

What is CVE-2026-8333?

A stored cross-site scripting vulnerability exists within Microchip's TimePictra platform, where an authenticated, low-privileged attacker can store harmful script content. This malicious script is executed when other users access the affected page, potentially compromising user data and session security. Effective countermeasures are necessary to prevent exploitation, making awareness and prompt remediation vital for safeguarding users.

Affected Version(s)

TimePictra 0 < 12.0

References

https://www.microchip.com/en-us/solutions/technologies/em...
vendor-advisory
https://www.gruppotim.it/en/footer/TIM-red-team.html
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dario Emilio Bertani
Andrea Sindoni
Antonio Carriero
Marco Manieri
Vito Pistillo
Davide Renna
Renna Leone
Massimiliano Brolli
TIM Security Red Team Research
.