Schneider Electric patches XXE flaw in Data Center Expert
An XML External Entity vulnerability in Schneider Electric EcoStruxure IT Data Center Expert versions ≤9.1.1 could allow authenticated attackers to disclose server-side files; patch available.
Schneider Electric has disclosed and patched CVE-2026-8045, an XML External Entity (XXE) injection vulnerability in its EcoStruxure IT Data Center Expert monitoring software. The flaw, classified under CWE-611, allows an authenticated attacker with a valid Data Center Expert user account to submit crafted XML payloads to SOAP service endpoints, potentially disclosing server-side file contents. The vulnerability affects versions 9.1.1 and prior of the data center monitoring platform, which is deployed globally across critical infrastructure sectors including information technology, critical manufacturing, and energy.
Schneider Electric has released version 9.1.2 to address the vulnerability. The company's CPCERT team reported the issue to CISA, with additional credit to Vincent Michel of Formind Company for independent discovery and responsible disclosure. Organizations running affected versions should prioritize applying the vendor-supplied patch and follow standard industrial control system security practices, including network segmentation, physical access controls, and restricting internet exposure of control system devices.
While the vulnerability requires authenticated access and targets a specific monitoring application rather than operational technology directly, the potential for information disclosure in environments managing critical infrastructure warrants prompt remediation. The availability of a vendor patch and the authentication requirement reduce immediate exploitation risk, but organizations should validate their deployment versions and plan updates accordingly.
Mentioned in this report
Detection guidance
XXE Payload Submitted to SOAP Endpoint (Potential CVE-2026-8045 Exploitation)
Detects HTTP POST requests to SOAP service endpoints containing DOCTYPE/ENTITY declarations indicative of XXE injection attempts against Data Center Expert or similar SOAP-based web services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: XXE Payload Submitted to SOAP Endpoint
id: 1e336f99-8966-57b9-a07f-e1ef127e80f7
status: experimental
description: 'Detects web requests to SOAP service endpoints that contain XML External
Entity
(XXE) indicators such as inline DOCTYPE and ENTITY SYSTEM declarations. This
pattern matches exploitation attempts against XXE vulnerabilities like
CVE-2026-8045 in Schneider Electric EcoStruxure IT Data Center Expert, where an
authenticated attacker submits crafted XML to a SOAP endpoint to disclose local
file contents.
'
logsource:
category: webserver
logsource_note: Applies to web server / reverse proxy / WAF access logs capturing
request URI and body content.
detection:
selection_endpoint:
cs-uri-path|contains:
- /soap
- /services
- .asmx
- /ws/
selection_method:
cs-method: POST
selection_xxe:
cs-body|contains:
- <!DOCTYPE
- <!ENTITY
- 'SYSTEM "file:'
- SYSTEM "http
condition: selection_endpoint and selection_method and selection_xxe
falsepositives:
- Legitimate SOAP/XML validation tooling that intentionally includes DOCTYPE declarations
for schema validation
- Automated vulnerability scanners performing authorized XXE testing during penetration
tests
level: high
tags:
- attack.t1190
- attack.initial_access
- cve.2026-8045
author: Vorant
Web Application Process Reading Sensitive OS Files After SOAP Request Handling
Detects a web/application server process (e.g., Java/Tomcat hosting a SOAP monitoring service) accessing sensitive system configuration files, consistent with local file disclosure via an XXE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web App Process Accessing Sensitive Local Files
id: 881f889d-0bbf-5e1a-9b3a-711b1ba7d6d0
status: experimental
description: 'Detects a web application or Java-based service process opening sensitive
operating system configuration files (e.g. /etc/passwd, /etc/shadow,
win.ini, SAM hive backups) shortly after handling inbound HTTP/SOAP
requests. This behavior is consistent with an XXE vulnerability being
exploited to read local file contents from a server, such as
CVE-2026-8045 in Data Center Expert.
'
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- java
- tomcat
- jetty
selection_target:
TargetFilename|contains:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- .ssh/id_rsa
- /proc/self/environ
condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check agents that read system files
for monitoring purposes
- Configuration management tools (Ansible, Puppet) executed via the same Java runtime
level: medium
tags:
- attack.t1005
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free