High severity · published Feb 11, 2026
CVE-2026-1226
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted…
7.0
CVSS
0.2%
EPSS
No
On KEV
Description
CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EB
EcoStruxure Building Operation Webstation · Schneider Electric
All 6.0.x versions prior to 6.0.4.7000 (CP5) · source: vendor
EB
EcoStruxure Building Operation Workstation · Schneider Electric
All 7.0.x versions prior to 7.0.2 · source: vendor
In the news
AdvisoryHigh
Schneider Electric EcoStruxure Building Operation Workstation
View CSAF
Summary
Schneider Electric is aware of a vulnerability in EcoStruxure Building Operation Workstation and EcoStruxure Building Operation WebStation. [EcoStruxure Building Operation (EBO)](https://www.se.com/ww/en/product-range/62111-ecostruxure-building-operation-software/#overview) is an open and scalable software platform providing insight, control and management of multiple building systems and devices in one mobile-enabled convenient view. It delivers valuable data for decision-making to improve energy management and increase efficiency for better building performance and comfort, reduced carbon, and more sustainable building environments. Failure to apply the remediations below may risk exposure of local files or denial of service, which could result in data breaches, and operational disruptions.
The following versions of Schneider Electric EcoStruxure Building Operation Workstation are affected:
EcoStruxure Building Operation Workstation vers:generic/>=7.0.x|<7.0.3.2000_(CP1), 7.0.3.2000_CP1, vers:generic/>=6.x|<6.0.4.14001_(CP10), 6.0.4.14001_CP10, vers:intdot/>=7.0.x|<7.0.2, 7.0.2, vers:generic/>=6.0.x|<6.0.4.7000_(CP5), 6.0.4.7000_CP5 (CVE-2026-1227, CVE-2026-1227, CVE-2026-1226, CVE-2026-1226)
EcoStruxure Building Operation WebStation vers:generic/>=7.0.x|<7.0.3.2000_(CP1), 7.0.3.2000_CP1, vers:generic/>=6.x|<6.0.4.14001_(CP10), 6.0.4.14001_CP10, vers:intdot/>=7.0.x|<7.0.2, 7.0.2, vers:generic/>=6...
Feb 24, 2026·CISA Advisories
Affected product
EB
EcoStruxure Building Operation Webstation
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1226
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-041-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-02.pdf
More from EcoStruxure Building Operation Webstation
7.0
CVE-2026-1227
CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or…