CVE-2026-8045: CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints

Synopsis

An XML External Entity (XXE) injection vulnerability exists in Schneider Electric EcoStruxure IT Data Center Expert (versions 9.1.1 and prior). An attacker who holds a valid Data Center Expert user account can send crafted XML payloads to the product's SOAP service endpoints over the network, causing the server to parse and return the contents of files from its own filesystem. Successful exploitation reads arbitrary server-side files, disclosing potentially sensitive configuration or credential data. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SOAP service endpoints over the network; the vulnerable service is exposed via standard network connectivity.

• AuthenticationRequired

  A valid Data Center Expert user account is required; any low-privilege account is sufficient to submit crafted XML payloads.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits the malicious payload directly to the service without requiring any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access and a valid account.

Blast Radius

• The attacker reads arbitrary files from the server's filesystem, including configuration files, application settings, and potentially stored credentials.
• Sensitive operating-system files such as password stores or private key material accessible to the application process are exposed.
• There is no integrity or availability impact; the attacker cannot modify data or disrupt service through this vulnerability alone.
• Disclosure is limited to files readable by the process running the SOAP service, but on a data center management platform this scope can include highly sensitive operational data.