CVE-2026-8044 - CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters

Back Back to CVE browser

HIGH

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters

Published Sep 9, 2026

8.6

HIGH

CVSS 4.0

EPSS 0.67%

Description

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

Affected products

Vendor Schneider Electric Product n/a Default
unaffected
- Version
  Versions 9.1.2 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Schneider Electric

n/a

unaffected

Version	Status	Constraints
Versions 9.1.2 and prior	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-88

References (2)

Link	Providers	Tags
https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-251-01.pdf
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75097		Advisory