Ecostruxure Building Operation Workstation CVEs and Security Vulnerabilities

CVE-2026-1227

XML External Entity Disclosure in EBO TGML Upload

CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Schneider-electric

Products

Ecostruxure Building Operation Webstation Ecostruxure Building Operation Workstation

CVE-2026-1226

Malicious TGML File Allows Untrusted Code Execution in EcoStruxure Building Operation

CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file.