# Schneider Electric patches XXE flaw in Data Center Expert

Published: 2026-06-30 · Severity: medium · Sectors: manufacturing, energy
Canonical: https://vorant.io/reports/5f18d5e8-98dc-5140-bdda-95723a94f49b/schneider-electric-patches-xxe-flaw-in-data-center-expert

> An XML External Entity vulnerability in Schneider Electric EcoStruxure IT Data Center Expert versions ≤9.1.1 could allow authenticated attackers to disclose server-side files; patch available.

Schneider Electric has disclosed and patched CVE-2026-8045, an XML External Entity (XXE) injection vulnerability in its EcoStruxure IT Data Center Expert monitoring software. The flaw, classified under CWE-611, allows an authenticated attacker with a valid Data Center Expert user account to submit crafted XML payloads to SOAP service endpoints, potentially disclosing server-side file contents. The vulnerability affects versions 9.1.1 and prior of the data center monitoring platform, which is deployed globally across critical infrastructure sectors including information technology, critical manufacturing, and energy.

Schneider Electric has released version 9.1.2 to address the vulnerability. The company's CPCERT team reported the issue to CISA, with additional credit to Vincent Michel of Formind Company for independent discovery and responsible disclosure. Organizations running affected versions should prioritize applying the vendor-supplied patch and follow standard industrial control system security practices, including network segmentation, physical access controls, and restricting internet exposure of control system devices.

While the vulnerability requires authenticated access and targets a specific monitoring application rather than operational technology directly, the potential for information disclosure in environments managing critical infrastructure warrants prompt remediation. The availability of a vendor patch and the authentication requirement reduce immediate exploitation risk, but organizations should validate their deployment versions and plan updates accordingly.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8045

## Detection guidance (public sample)

### XXE Payload Submitted to SOAP Endpoint (Potential CVE-2026-8045 Exploitation)

ATT&CK: T1190

Detects HTTP POST requests to SOAP service endpoints containing DOCTYPE/ENTITY declarations indicative of XXE injection attempts against Data Center Expert or similar SOAP-based web services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: XXE Payload Submitted to SOAP Endpoint
id: 1e336f99-8966-57b9-a07f-e1ef127e80f7
status: experimental
description: 'Detects web requests to SOAP service endpoints that contain XML External
  Entity

  (XXE) indicators such as inline DOCTYPE and ENTITY SYSTEM declarations. This

  pattern matches exploitation attempts against XXE vulnerabilities like

  CVE-2026-8045 in Schneider Electric EcoStruxure IT Data Center Expert, where an

  authenticated attacker submits crafted XML to a SOAP endpoint to disclose local

  file contents.

  '
logsource:
  category: webserver
logsource_note: Applies to web server / reverse proxy / WAF access logs capturing
  request URI and body content.
detection:
  selection_endpoint:
    cs-uri-path|contains:
    - /soap
    - /services
    - .asmx
    - /ws/
  selection_method:
    cs-method: POST
  selection_xxe:
    cs-body|contains:
    - <!DOCTYPE
    - <!ENTITY
    - 'SYSTEM "file:'
    - SYSTEM "http
  condition: selection_endpoint and selection_method and selection_xxe
falsepositives:
- Legitimate SOAP/XML validation tooling that intentionally includes DOCTYPE declarations
  for schema validation
- Automated vulnerability scanners performing authorized XXE testing during penetration
  tests
level: high
tags:
- attack.t1190
- attack.initial_access
- cve.2026-8045
author: Vorant
```

### Web Application Process Reading Sensitive OS Files After SOAP Request Handling

ATT&CK: T1005

Detects a web/application server process (e.g., Java/Tomcat hosting a SOAP monitoring service) accessing sensitive system configuration files, consistent with local file disclosure via an XXE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web App Process Accessing Sensitive Local Files
id: 881f889d-0bbf-5e1a-9b3a-711b1ba7d6d0
status: experimental
description: 'Detects a web application or Java-based service process opening sensitive

  operating system configuration files (e.g. /etc/passwd, /etc/shadow,

  win.ini, SAM hive backups) shortly after handling inbound HTTP/SOAP

  requests. This behavior is consistent with an XXE vulnerability being

  exploited to read local file contents from a server, such as

  CVE-2026-8045 in Data Center Expert.

  '
logsource:
  category: file_event
  product: linux
detection:
  selection_process:
    Image|contains:
    - java
    - tomcat
    - jetty
  selection_target:
    TargetFilename|contains:
    - /etc/passwd
    - /etc/shadow
    - /etc/hosts
    - .ssh/id_rsa
    - /proc/self/environ
  condition: selection_process and selection_target
falsepositives:
- Legitimate administrative scripts or health-check agents that read system files
  for monitoring purposes
- Configuration management tools (Ansible, Puppet) executed via the same Java runtime
level: medium
tags:
- attack.t1005
- attack.collection
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5f18d5e8-98dc-5140-bdda-95723a94f49b/schneider-electric-patches-xxe-flaw-in-data-center-expert.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup