CVE-2026-8045: Data Center Expert XXE Vulnerability

CVE-2026-8045 Overview

CVE-2026-8045 is an XML External Entity (XXE) vulnerability [CWE-611] affecting Schneider Electric Data Center Expert. The flaw resides in SOAP service endpoints that improperly process XML input. An authenticated attacker holding a Data Center Expert user account can submit crafted XML payloads to disclose server-side file contents. Schneider Electric documented the issue in security notice SEVD-2026-160-01. The vulnerability requires low-privilege authentication and is exploitable over the network without user interaction.

Critical Impact
Authenticated attackers can read arbitrary server-side files by submitting crafted XML payloads to SOAP endpoints, exposing configuration data, credentials, and system files.

Affected Products

Schneider Electric Data Center Expert (refer to SEVD-2026-160-01 for affected versions)
SOAP service endpoints processing external XML entities
Deployments accessible to authenticated Data Center Expert users

Discovery Timeline

2026-06-09 - CVE-2026-8045 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-8045

Vulnerability Analysis

The vulnerability stems from improper restriction of XML External Entity references in the SOAP service XML parser. The parser resolves external entities defined within incoming SOAP requests instead of disabling external entity processing. Attackers leverage this behavior to instruct the parser to read local files and return their contents within SOAP responses or error messages.

Exploitation requires a valid Data Center Expert user account. After authentication, the attacker submits a SOAP request containing a malicious DOCTYPE declaration with an external entity reference pointing to a local file path. The XML parser dereferences the entity and embeds the file contents in the resulting XML document, which the SOAP service returns to the attacker.

The EPSS score for this vulnerability is 0.057% as of 2026-06-11, reflecting low observed exploitation activity at publication time.

Root Cause

The SOAP service uses an XML parser configured with default settings that resolve external entities. The application fails to disable DOCTYPE declarations or restrict entity resolution at the parser level. This configuration violates secure XML processing guidance for handling untrusted XML inputs.

Attack Vector

The attack vector is network-based and requires authentication as a Data Center Expert user. Confidentiality impact is high because the parser can read any file readable by the service account. Integrity and availability are not affected. The attacker sends an HTTP request containing a SOAP envelope with an external entity declaration that references files such as /etc/passwd, application configuration files, or stored credentials.

The vulnerability mechanism follows the standard XXE pattern: a DOCTYPE block defines an external entity using the SYSTEM keyword with a file:// URI, then references that entity inside a SOAP parameter value. See the Schneider Electric Security Notice SEVD-2026-160-01 for vendor technical details.

Detection Methods for CVE-2026-8045

Indicators of Compromise

SOAP requests containing <!DOCTYPE declarations or <!ENTITY definitions in the request body
Outbound DNS or HTTP requests from the Data Center Expert host to attacker-controlled domains indicating out-of-band XXE
SOAP responses containing fragments of system files such as /etc/passwd or application configuration content
Authenticated SOAP traffic from accounts that do not typically issue API requests

Detection Strategies

Inspect HTTP request bodies destined for Data Center Expert SOAP endpoints for SYSTEM, PUBLIC, or file:// strings within XML
Correlate authenticated user sessions with anomalous XML payload structures and elevated response sizes
Alert on application errors generated by XML parsers referencing entity resolution failures

Monitoring Recommendations

Enable verbose logging on the Data Center Expert SOAP service and forward logs to a centralized analytics platform
Monitor egress traffic from the Data Center Expert host for unexpected outbound connections that may indicate out-of-band data exfiltration
Audit Data Center Expert user account activity, focusing on low-privilege accounts issuing SOAP requests

How to Mitigate CVE-2026-8045

Immediate Actions Required

Apply the security update referenced in Schneider Electric advisory SEVD-2026-160-01
Restrict network access to Data Center Expert SOAP endpoints to trusted management networks
Rotate credentials and review the audit log for any Data Center Expert accounts that may have been used to exploit the vulnerability
Inventory files accessible to the Data Center Expert service account and remove sensitive content where possible

Patch Information

Schneider Electric published remediation guidance in the Schneider Electric Security Notice SEVD-2026-160-01. Administrators should consult the advisory for fixed versions and upgrade procedures specific to their Data Center Expert deployment.

Workarounds

Limit Data Center Expert user account provisioning and remove unused accounts to reduce the authenticated attack surface
Place a web application firewall in front of Data Center Expert SOAP endpoints with rules blocking DOCTYPE and ENTITY declarations in XML payloads
Restrict outbound network connectivity from the Data Center Expert server to prevent out-of-band data exfiltration
Segment the Data Center Expert management interface from general user networks until the patch is applied

bash

# Example WAF rule pattern to block XML payloads containing DOCTYPE declarations
# ModSecurity rule blocking inbound XML with external entity declarations
SecRule REQUEST_BODY "@rx (?i)<!DOCTYPE[^>]+(SYSTEM|PUBLIC)" \
    "id:1008045,phase:2,deny,status:403,\
    msg:'XXE attempt blocked - CVE-2026-8045',\
    tag:'CWE-611'"