Schneider Electric Ecostruxure Building Operation Webstation vulnerabilities

2 CVEs affecting Schneider Electric Ecostruxure Building Operation Webstation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1227, published 2026-02-11.

More from Schneider Electric.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-1226, published 2026-02-11. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is…
• CVE-2026-1227, published 2026-02-11. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service…