Read the docs
TI-2026-84997 Aliases CVE-2026-95649GHSA-58m7-7939-mrxp

Untrusted scripts in IRISPowerscan allow arbitrary code execution

Priority LOW 26CWE-829Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

I.R.I.S S.A. IRISPowerscan versions from 0 through 12.3 are affected. The application does not sufficiently restrict untrusted scripts (CWE-829). An authenticated user with access to script functionality can import or modify scripts that the application executes, running arbitrary code as the Windows user running IRISPowerscan.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.

Why it matters now

EPSS 0.00139 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
I.R.I.S S.A.IRISPowerscanup to 12.3—No fix listedCNA
  • IRISPowerscan VendorI.R.I.S S.A. Affected up to 12.3 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for IRISPowerscan.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-95649
  2. 2026-11-04 Alias added: GHSA-58m7-7939-mrxp
  3. 2026-11-05 Priority changed: MEDIUM → LOW

References

Patch 1

  • TI-2026-84996 Insecure default privilege assignment in IRISPowerscan CVSS 4.0HIGH 7.2
  • TI-2026-84995 Default accounts with predictable credentials in IRISPowerscan CVSS 4.0HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences