This vulnerability (CVE-2026-12621) in Microchip GridTime 3000 is an instance of CWE-79: improper neutralization of input during web page generation, specifically in the password reset form. It allows an attacker with low privileges and no user interaction to potentially execute cross-site scripting attacks with low impact on confidentiality and integrity. The affected versions include 1.0r0.03 and all versions prior to 1.2r0.0. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking or other client-side impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality and integrity. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the password reset form or applying web application firewall rules to detect and block malicious input targeting this vulnerability.