CVE-2026-8045 identifies an Improper Restriction of XML External Entity Reference vulnerability (CWE-611) in Schneider Electric's EcoStruxure IT Data Center Expert software, affecting versions 9.1.1 and earlier. This vulnerability relates to how XML input is processed, potentially allowing external entity references that could be exploited. The vendor advisory does not provide explicit patch or remediation details but emphasizes adherence to cybersecurity best practices to mitigate risks. No cloud service is involved, and no known active exploitation has been reported.

The vulnerability could allow an attacker to exploit XML external entity processing in the affected software, potentially leading to information disclosure or other impacts typical of XXE vulnerabilities. However, no specific impact details or exploit reports are provided. There are no known exploits in the wild currently.

No official patch or fix is currently documented. Schneider Electric recommends implementing industry cybersecurity best practices, including isolating control and safety system networks behind firewalls, restricting physical access, securing remote access via VPNs, and sanitizing mobile data exchange methods. Users should monitor Schneider Electric advisories for any future patches or updates addressing this vulnerability.