VulnerabilityModified

CVE-2018-8840

A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow…

CRITICAL 9.8EPSS 8.63%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (8.63%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 8.63% probability · 95th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-121, CWE-119
Affected: indusoft/web studio · industrial-software/intouch machine edition 2017
Source: ics-cert@hq.dhs.gov

EPSS trend

EPSS moved from 7.2% on 21 September 2026 to 8.6% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

References

http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/Third Party Advisory
http://www.securityfocus.com/bid/103949Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2018-07Third Party Advisory
http://software.schneider-electric.com/pdf/security-bulletin/lfsec00000125/Third Party Advisory
http://www.securityfocus.com/bid/103949Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-107-01Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2018-07Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.