CVE-2026-78556

HighCVSS 7.4

Published: 13/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of server certificate validation when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity.

Risk Assessment

The risk includes the possibility of intercepting sensitive data and compromising communication confidentiality, potentially leading to data theft or unauthorized access.

Recommendation

Update to version V1.27.9 or later and enforce strict TLS certificate validation.

Other vulnerabilities in Industrial Edge App Publisher

CVE-2026-78557High
A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of sanitization of data received from the backend before rendering in the user interface. Because the front end is integrated with Node.js, this allows execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine.

Original NVD description (English source)

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS