Is CVE-2026-82776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82776 being exploited in the wild.

How severe is CVE-2026-82776?

Medium severity, with a CVSS score of 6.1, published 14 September 2026.

Which products and versions are affected?

Contec CONPROSYS PAC Series Integrated Type CPS-PC341*-*-9201 and Configurable Type CPS-PCS341*-DS1-1201 versions prior to 3.0.0.

Is there a fix for CVE-2026-82776?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82776 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82776?

Check whether you run Contec CONPROSYS PAC Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82776: Contec CONPROSYS PAC Series cross-site scripting

CVE-2026-82776 · Severity: medium · CVSS 6.1 · Published 2026-09-14

CONPROSYS PAC Series is an industrial automation controller used in factory and manufacturing environments to manage machine operations and data collection. A cross-site scripting vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of logged-in operators or administrators, potentially enabling them to steal credentials, manipulate system settings, or access sensitive operational data displayed in the web interface.

Vendors: Contec.

Quick answers

Is CVE-2026-82776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82776 being exploited in the wild.
How severe is CVE-2026-82776?: Medium severity, with a CVSS score of 6.1, published 14 September 2026.
Which products and versions are affected?: Contec CONPROSYS PAC Series Integrated Type CPS-PC341*-*-9201 and Configurable Type CPS-PCS341*-DS1-1201 versions prior to 3.0.0.
Is there a fix for CVE-2026-82776?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82776 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82776?: Check whether you run Contec CONPROSYS PAC Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a CWE-79 (Cross-site Scripting / XSS) vulnerability in the CONPROSYS PAC Series web interface. The vulnerability occurs because user-supplied input is not properly sanitized before being rendered in the victim's browser. An attacker can craft a malicious link or inject payload via a vulnerable parameter; when a logged-in user visits or interacts with the malicious content, the arbitrary script executes in their session context. No authentication is required to craft the attack, but the victim must be logged in for the script to have access to sensitive operations. The vulnerability affects CONPROSYS PAC integrated models (CPS-PC341*) and configurable models (CPS-PCS341*) prior to version 3.0.0. Patches are available in version 3.0.0 and later.

Affected products

Contec CONPROSYS PAC Series Integrated Type CPS-PC341*-*-9201 and Configurable Type CPS-PCS341*-DS1-1201 versions prior to 3.0.0

Timeline

2026-09-10: disclosed
2026-09-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.