CVE-2026-22615 Code injection in IPP Software

Medium 6.0 Published 16 Apr 2026 Updated 16 Apr 2026

An attacker with admin privileges can inject malicious code via XML input to execute arbitrary commands on the local system.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-22615?

CVE-2026-22615 is a medium-severity code injection vulnerability in Eaton IPP Software, published on 16 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre.

Weakness: CWE-20

Which versions are affected by CVE-2026-22615?

It affects 1 product.

Products include Eaton Intelligent Power Protector.

How do I fix CVE-2026-22615?

No fix has been published for CVE-2026-22615 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-22615 being exploited?

There is no known exploitation of CVE-2026-22615 in the wild and no public exploit code.

Sources

Also known as GHSA-w622-v92m-9f53.