CPA2026-057 – Vulnerabilities Affecting IRISPowerscan

November 4, 2026

 

Vulnerabilities have been identified in IRISPowerscan relating to default user accounts with predictable credentials (CVE-2026-94459), insecure default privilege assignment (CVE-2026-94460), and insufficient restriction of untrusted scripts (CVE-2026-95649). 

Successful exploitation of these vulnerabilities would require an attacker to have access to the local network (adjacent network). Depending on which of the vulnerabilities is exploited (see below for further detail), an attack could potentially result in unauthorized access to application functionality, unauthorized modification of application data or configuration, access to privileged functionality, or arbitrary code execution. The existing IRISPowerscan Security White Paper outlines steps to mitigate predictable credentials and insecure default privilege assignment vulnerabilities.

Affected Versions:

IRISPowerscan: Version 12.3 and earlier.

Remediation/Mitigation:

Canon, in collaboration with IRIS, takes security vulnerabilities seriously and recommends that customers using affected versions of IRISPowerscan upgrade to the latest available version. To further strengthen security and address these vulnerabilities, IRIS has released IRISPowerscan version 12.4 or later, which includes security updates for CVE-2026-94459, CVE-2026-94460, and CVE-2026-95649.

At this time, Canon and IRIS have not received any reports of active exploitation of these vulnerabilities, however, we strongly recommend that customers review this security advisory and upgrade to the latest version of IRISPowerscan. The fixed version is available from the Download Centre in the IRIS Partner Portal and further details can be found under Technical News on this portal. 

If you require assistance with the update, please contact our support team.

CVE/CVSS:

CVE-2026-94459: IRISPowerscan Default accounts with predictable credentials. CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Base Score: 7.2.

CVE-2026-94460: IRISPowerscan Insecure default privilege assignment for installation account. CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Base Score: 7.2.

CVE-2026-95649: IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution. CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N Base Score: 6.1.

Credits:

Canon would like to thank the following researcher for identifying and responsibly disclosing these vulnerabilities:

• CVE-2026-94459, CVE-2026-94460, and CVE-2026-95649: Paul van der Haas working with Orange Cyberdefense