This vulnerability arises from improper input validation in the Eaton IPP software's XML processing, allowing an attacker who already has admin privileges and local access to inject malicious code. This can result in arbitrary command execution on the affected system. The issue is tracked as CVE-2026-22615 and is classified under CWE-20 (Improper Input Validation). The CVSS 3.1 vector indicates network attack vector with high attack complexity, requiring privileges and user interaction, resulting in low confidentiality impact but high integrity and availability impacts. Eaton has fixed the vulnerability in the latest software version available on their download center.

Successful exploitation allows an attacker with administrative and local system access to execute arbitrary commands, potentially compromising system integrity and availability. Confidentiality impact is low. There are no known exploits in the wild currently.

A fixed version of Eaton IPP software addressing this vulnerability is available on the Eaton download center. Users should upgrade to the latest version to remediate this issue. Patch status is confirmed by the vendor advisory indicating an official fix is available.