CVE-2026-78557: XSS

Q: Which versions should be prioritized for remediation?

All Siemens Industrial Edge App Publisher versions earlier than V1.27.9 are affected. Upgrade to V1.27.9 or later.

Q: What must occur for exploitation to succeed?

An attacker must cause unsanitized backend-provided data to be rendered in the application's user interface. Exploitation also requires user interaction, as indicated by the UI:R attack vector.

Q: What is the potential impact on an affected user machine?

The injected content can execute arbitrary JavaScript in the integrated Node.js front end. This can be leveraged to achieve remote code execution on the victim's machine, with high confidentiality, integrity, and availability impact.

Published Oct 13, 2026

Updated

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

Affected Software

1 affected component

Siemens Industrial Edge App Publisher<1.27.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Industrial Edge App Publisher to a version that resolves this vulnerability.
Fixed in V1.27.9

Event History

Oct 13, 2026

CVE Published

via MITRE·09:18 AM

Data Sourced

via MITRE·09:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which versions should be prioritized for remediation?

All Siemens Industrial Edge App Publisher versions earlier than V1.27.9 are affected. Upgrade to V1.27.9 or later.

What must occur for exploitation to succeed?

An attacker must cause unsanitized backend-provided data to be rendered in the application's user interface. Exploitation also requires user interaction, as indicated by the UI:R attack vector.

What is the potential impact on an affected user machine?

The injected content can execute arbitrary JavaScript in the integrated Node.js front end. This can be leveraged to achieve remote code execution on the victim's machine, with high confidentiality, integrity, and availability impact.

CVE-2026-78557: XSS

Affected Software

Remediation

Event History

Frequently Asked Questions

Which versions should be prioritized for remediation?

What must occur for exploitation to succeed?

What is the potential impact on an affected user machine?

Company

Resources

Contact

Frequently Asked Questions

Which versions should be prioritized for remediation?

What must occur for exploitation to succeed?

What is the potential impact on an affected user machine?