CVE-2026-78557CWE-79cross-site-scripting

CVE-2026-78557

High · published October 13, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
7.7 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00452 · 38.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-13T14:17Z
References (1)
https://cert-portal.siemens.com/productcert/html/ssa-968435.html · [email protected]
EPSS history
Timeline
  • 15 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 13 OCT 09:18Z
    A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
    cvelistv5
  • 13 OCT 09:18Z
    A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)
    cvelistv5