CVE-2026-8331

CVSS 8.8 (high) · published 2026-11-12

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

Weakness: CWE-434

Source: NVD CVE-2026-8331

References

• https://www.gruppotim.it/en/footer/TIM-red-team.html
• https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-remote-code-execution-via-file-upload

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.