TIMEPICTRA · CVE-2026-8332 · Infrastructure
FIX → 12.0 ✓ verified
Microchip's TimePictra platform ships installation files containing a hard-coded root password. Anyone who obtains those files can log in with privileged root credentials.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run the self-hosted Microchip TimePictra platform (timing and synchronization management) in versions before 12.0. An attacker needs access to the installation files (RPM packages) to read the hard-coded root password, so exposure depends on who can reach those files and the installed system. Teams on 12.0 or later can skip it.
Who cares microchip, self-hosted, timepictra
Upgrade to 12.0
Upgrade TimePictra platform to 12.0 or later; its RPM installation files no longer expose the root password.
A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.