Insufficient Script Restriction in IRISPowerscan by Canon
CVE-2026-95649

6.1MEDIUM

Key Information:

Vendor

I.r.i.s S.a.

Status
Irispowerscan
Vendor
CVE Published:
4 November 2026

What is CVE-2026-95649?

IRISPowerscan from Canon has a security issue where the application insufficiently restricts the use of untrusted scripts. This vulnerability allows an authenticated user with access to script functionality to import or modify scripts that the application executes. If exploited, this vulnerability can lead to arbitrary code execution, posing a significant risk to the security context of the Windows user running IRISPowerscan.

Affected Version(s)

IRISPowerscan Windows 0 <= 12.3

References

https://www.canon-europe.com/psirt/advisory-information
vendor-advisorymitigationpatch

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Paul van der Haas working with Orange Cyberdefense
.