Is CVE-2026-12496 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12496 being exploited in the wild.

How severe is CVE-2026-12496?

Informational severity, with a CVSS score of 8.7, published 24 July 2026.

Which products and versions are affected?

LOYTEC L-DALI through 8.4.16; LOYTEC L-GATE through 8.4.16; LOYTEC L-INX through 8.4.16; LOYTEC L-IOB through 8.4.16; and 4 more.

Is there a fix for CVE-2026-12496?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12496 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12496?

Check whether you run LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12496: Loytec Multiple Products Stored XSS in OPC XML-DA Server Statistics

CVE-2026-12496 · Severity: info · CVSS 8.7 · Published 2026-07-24

Loytec automation and building management devices are vulnerable to a security flaw where malicious code can be stored on the device by an unauthenticated user. When an administrator later views the device's server statistics page, this code executes in their browser. This could allow an attacker to hijack administrative sessions, steal login credentials, or change device configurations, potentially disrupting building operations.

Technologies: LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX, LOYTEC L-IOB, LOYTEC L-PAD, LOYTEC L-ROC, LOYTEC L-VIS, LOYTEC LIP-ME201C. Vendors: LOYTEC.

Quick answers

Is CVE-2026-12496 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12496 being exploited in the wild.
How severe is CVE-2026-12496?: Informational severity, with a CVSS score of 8.7, published 24 July 2026.
Which products and versions are affected?: LOYTEC L-DALI through 8.4.16; LOYTEC L-GATE through 8.4.16; LOYTEC L-INX through 8.4.16; LOYTEC L-IOB through 8.4.16; and 4 more.
Is there a fix for CVE-2026-12496?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12496 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12496?: Check whether you run LOYTEC L-DALI, LOYTEC L-GATE, LOYTEC L-INX or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the OPC XML-DA server endpoint (/da) of multiple Loytec building automation products. The server logs incoming SOAP requests and displays client metadata, specifically the User-Agent header, on the statistics page (/webui/statistics/opc_srv) without proper sanitization or output encoding. An unauthenticated remote attacker can inject malicious JavaScript via a crafted User-Agent header in a POST request. The payload is executed when an authenticated administrator views the statistics page, potentially leading to session hijacking or full device reconfiguration. The vulnerability is addressed in firmware version 8.4.18.

Affected products

Loytec LIP-ME201C through 8.4.16
Loytec L-INX through 8.4.16
Loytec L-GATE through 8.4.16
Loytec L-ROC through 8.4.16
Loytec L-IOB through 8.4.16
Loytec L-DALI through 8.4.16
Loytec L-VIS through 8.4.16
Loytec L-PAD through 8.4.16

Timeline

2026-07-24: disclosed
2026-07-24: advisory

References

https://www.loytec.com/support/product-security/advisories/8522-dibt-cve-20260526-0004-unauthenticated-stored-xxs-in-opc-xml-da-server-statistics-high

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.