{"affected":[{"defaultStatus":"unaffected","platforms":["Windows"],"product":"IRISPowerscan","source":"CNA: Canon_EMEA","vendor":"I.R.I.S S.A.","versions":[{"lessThanOrEqual":"12.3","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-95649","cwes":["CWE-829"],"description":"IRISPowerscan insufficiently restrict the use of\nuntrusted scripts. An authenticated user with access to script functionality\ncan import or modify scripts that are executed by the application, potentially\nresulting in arbitrary code execution in the security context of the Windows\nuser running IRISPowerscan.","epss":{"date":"2026-11-04","percentile":0.10997,"score":0.00208},"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: Canon_EMEA","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":6.1,"severity":"medium","source":"NVD: 4586e0a2-224d-4f8a-9cb4-8882b208c0b3","vector":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1793787447120,"publishedAt":1793783654423,"references":[{"source":"CNA: Canon_EMEA","tags":["vendor-advisory","mitigation","patch"],"url":"https://www.canon-europe.com/psirt/advisory-information"},{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","tags":[],"url":"https://www.canon-europe.com/psirt/advisory-information"}],"remediation":[{"kind":"fix","source":"CNA: Canon_EMEA","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.canon-europe.com/psirt/advisory-information"}],"revision":"b0be4b1512f90aea8bdf5a84beaee1401b3138513859651e4b30279a9c8184a4","sources":[{"modifiedAt":1793783654423,"name":"CNA: Canon_EMEA","retrievedAt":1793786942564,"url":"https://www.cve.org/CVERecord?id=CVE-2026-95649"},{"modifiedAt":1793787447120,"name":"NVD","retrievedAt":1793794573364,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95649"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793858590370,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-95649"}],"ssvc":null,"status":"published","title":"IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution","updatedAt":1793858590370}