CVE-2026-36226

MediumCVSS 6.1

Published: 22/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

A Cross-Site Scripting (XSS) vulnerability was detected in Advantech WebAccess/SCADA 8.0-2015.08.16 in the Create New Project User component, in the decryption field. A remote attacker can obtain sensitive information.

Risk Assessment

An attacker can remotely inject a malicious script that executes in the victim's browser, potentially leading to theft of sensitive data, including credentials.

Recommendation

Update Advantech WebAccess/SCADA to the latest version or apply a patch to prevent XSS.

Other vulnerabilities in Advantech WebAccess/SCADA

CVE-2025-14849High
Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

Original NVD description (English source)

Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption field in the Create New Project User component

Vulnerability data from NVD (NIST) · CISA KEV · EPSS