CVE-2026-8044: schneider electric ecostruxure™ it data center expert (formerly known as struxureware data center expert) Argument Injection

Vulnerability summary

CVE-2026-8044 is a high (CVSS 8.6) Argument Injection vulnerability in schneider electric ecostruxure™ it data center expert (formerly known as struxureware data center expert). EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.

Timeline

1. 09-09-2026
   PublishedVulnerability first disclosed.
2. 11-09-2026
   Last modifiedVulnerability information updated.

Description

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.