CISA 2026-06-30

Schneider Electric EcoStruxure IT Data Center Expert

CVE-2026-8045

Machine-generated analysis · WAYSCloud LLM

The advisory states that affected versions of EcoStruxure IT Data Center Expert are susceptible to XML external entity reference exploitation, which could lead to server-side file disclosure when crafted payloads are submitted via SOAP endpoints.

Context

EcoStruxure IT Data Center Expert is a monitoring software that collects and manages critical device information in data centers. The advisory identifies a vulnerability (CVE-2026-8045) involving improper restriction of XML external entity references, which could result in information disclosure. This issue affects versions 9.1.1 and prior, with a vendor-provided fix available in version 9.1.2. The product is deployed worldwide and used in sectors including information technology, critical manufacturing, and energy.

Operator considerations

Check: Inventory instances of EcoStruxure IT Data Center Expert to identify versions equal to or earlier than 9.1.1.
Patch: Upgrade to version 9.1.2 or later, as a vendor fix is available.
Log: Monitor access to SOAP service endpoints, particularly for XML payloads from authenticated users.

From Cybersecurity and Infrastructure Security Agency ↗

Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Data Center Expert. The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure.

The following versions of Schneider Electric EcoStruxure IT Data Center Expert are affected:

EcoStruxure IT Data Center Expert vers:intdot/

Read the full advisory on CISA →