CVE-2026-25787: Critical XSS in Motion Control Diagnostics

The National Vulnerability Database has disclosed CVE-2026-25787, a critical cross-site scripting (XSS) vulnerability impacting the web interface of unspecified devices. Rated 9.1 CVSS, this flaw stems from improper validation and sanitization of Technology Object (TO) names on the “Motion Control Diagnostics” page. An authenticated attacker, authorized to download a TIA project, can inject malicious scripts into this page.

This isn’t a speculative threat. If a legitimate user with appropriate permissions accesses the affected diagnostics page, the injected malicious code will execute within their web session. This means session hijacking, credential theft, or further client-side exploitation are all on the table, all originating from what appears to be a benign interaction with the web interface.

The attacker’s calculus here is clear: leverage a trusted internal process (TIA project download) to establish persistence and elevate privileges within the web application, effectively turning legitimate diagnostic activity into a vector for compromise. Defenders need to recognize that even highly privileged internal actions can be weaponized if input validation is weak.