Vulnerabilities

Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on…

Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Oracle

Product

java

CVSS

6.1

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-63356 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 21
   CISA advisory CISA 9d ago

   Siemens SIMATIC S7 PLCs Web Server

   CVSS 3.1 No fix yet CVE-2026-63350CVE-2026-63351CVE-2026-63352+5 more Siemens
2. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page.

   CVSS 6.1 CVE-2026-63357 Oracle
3. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace…

   CVSS 6.1 CVE-2026-63355 Oracle
4. 3
   CVE NVD 19d ago

   Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page.

   CVSS 6.1 CVE-2026-63352 Oracle