CVE-2026-95649: IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution
Published Nov 4, 2026
·Updated
IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running IRISPowerscan.
Event History
Nov 4, 2026
CVE Published
via MITRE·09:14 AM
Data Sourced
via MITRE·09:14 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need?
The attacker must be an authenticated user with access to IRISPowerscan's script functionality. They must be able to import or modify scripts executed by the application.
2
What privileges could successful code execution have?
Code may execute in the security context of the Windows user running IRISPowerscan. The resulting impact therefore depends on that Windows account's privileges.