CVE-2026-8331 TimePictra ermote code execution via file upload

HighCVSS 8.8 EPSS 0.56%

Published: 2026-11-12 08:21
Updated: 2026-11-13 00:09
Exploit status: No public exploit known

Description

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

Affected products

Product	Affected versions	Fixed in
Microchip TimePictra	< 12.0	12.0

References

www.microchip.com vendor-advisory
www.gruppotim.it third-party-advisory

CVSS v4.0

8.8 High

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: Low
User Interaction: Active
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (2)

v4.0 8.8 · microchip
v4.0 8.8 · dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.56% (percentile 47.4)
CWE: CWE-434 Unrestricted upload of file with dangerous type

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.