Schneider Electric patches XXE flaw in Data Center Expert
An XML External Entity vulnerability in Schneider Electric EcoStruxure IT Data Center Expert versions ≤9.1.1 could allow authenticated attackers to disclose server-side files; patch available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric has disclosed and patched CVE-2026-8045, an XML External Entity (XXE) injection vulnerability in its EcoStruxure IT Data Center Expert monitoring software. The flaw, classified under CWE-611, allows an authenticated attacker with a valid Data Center Expert user account to submit crafted XML payloads to SOAP service endpoints, potentially disclosing server-side file contents. The vulnerability affects versions 9.1.1 and prior of the data center monitoring platform, which is deployed globally across critical infrastructure sectors including information technology, critical manufacturing, and energy.
Schneider Electric has released version 9.1.2 to address the vulnerability. The company's CPCERT team reported the issue to CISA, with additional credit to Vincent Michel of Formind Company for independent discovery and responsible disclosure. Organizations running affected versions should prioritize applying the vendor-supplied patch and follow standard industrial control system security practices, including network segmentation, physical access controls, and restricting internet exposure of control system devices.
While the vulnerability requires authenticated access and targets a specific monitoring application rather than operational technology directly, the potential for information disclosure in environments managing critical infrastructure warrants prompt remediation. The availability of a vendor patch and the authentication requirement reduce immediate exploitation risk, but organizations should validate their deployment versions and plan updates accordingly.
Mentioned in this report
Detection guidance
Web Application Process Reading Sensitive OS Files After SOAP Request Handling
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web/application server process (e.g., Java/Tomcat hosting a SOAP monitoring service) accessing sensitive system configuration files, consistent with local file disclosure via an XXE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web App Process Accessing Sensitive Local Files
id: 881f889d-0bbf-5e1a-9b3a-711b1ba7d6d0
status: experimental
description: 'Detects a web application or Java-based service process opening sensitive
operating system configuration files (e.g. /etc/passwd, /etc/shadow,
win.ini, SAM hive backups) shortly after handling inbound HTTP/SOAP
requests. This behavior is consistent with an XXE vulnerability being
exploited to read local file contents from a server, such as
CVE-2026-8045 in Data Center Expert.
'
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- java
- tomcat
- jetty
selection_target:
TargetFilename|contains:
- /etc/passwd
- /etc/shadow
- /etc/hosts
- .ssh/id_rsa
- /proc/self/environ
condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check agents that read system files
for monitoring purposes
- Configuration management tools (Ansible, Puppet) executed via the same Java runtime
level: medium
tags:
- attack.t1005
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs