We detect you are using an unsupported browser. For the best experience, please visit the site using Chrome, Firefox, Safari, or Edge. X

Maximize Your Experience: Reap the Personalized Advantages by Completing Your Profile to Its Fullest. Update Here

Stay in the loop with the latest from Microchip. Update your profile while you are at it. Update Here

Complete your profile to access more resources. Update Here

PSIRT-139: TimePictra Platform Stored Cross-Site Scripting Vulnerability

Vulnerability Details

Date of Disclosure: 04/09/2026

Publication Date: 11/09/2026

Affected Product: Microchip TimePictra^® Platform

Vulnerability Type: Improper neutralization of input during web page generation (CWE-79)
CVE Identifier: CVE-2026-8333
CVSS Score: 9.4 (CVSS 4.0)
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Description:
- A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page
Affected Versions: TimePictra platform versions before 12.0
Vulnerability Status: Resolved in TimePictra 12.0 platform

Risk Assessment

Successful exploitation could allow malicious script execution in a user's browser, enabling unauthorized actions or access to sensitive information in the context of the affected user.

Mitigation

Upgrade to TimePictra 12.0 platform or later

Patch/Release Information

TimePictra 12.0 platform properly neutralizes affected input during web page generation.

Acknowledgements

Reported by Dario Emilio Bertani, Andrea Sindoni, Antonio Carriero, Marco Manieri, Vito Pistillo, Davide Renna, Renna Leone and Massimiliano Brolli of TIM Security Red Team Research.

Recommendations

It is strongly recommended that all customers upgrade to the TimePictra 12.0 platform or later.