This vulnerability (CVE-2026-12621) involves improper input neutralization in the password reset form of Microchip GridTime 3000, allowing an attacker to inject malicious scripts (XSS). The affected versions are from 1.0r0.03 before 1.2r0.0. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality and integrity. No vendor advisory or patch information is available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking or other client-side impacts. The vulnerability affects confidentiality and integrity at a low level. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the password reset functionality or implementing web application firewall rules to detect and block malicious input targeting this form.