---
id: "CVE-2026-8332"
page: "https://infrastack.ai/live/CVE-2026-8332"
kind: "vulnerability"
aliases: ["CVE-2026-8332"]
title: "Microchip TimePictra: hard-coded root password in installation files exposes admin access"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "TimePictra", "fixed": ["12.0"], "affected": "< 12.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "microchip", "self-hosted", "timepictra"]
not_affected_if: []
published_at: "2026-11-12T07:16:48+00:00"
first_seen_at: "2026-11-12T07:37:04+00:00"
updated_at: "2026-11-12T07:39:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8332", "first_seen_at": "2026-11-12T07:37:04+00:00"}, {"source": "analyst", "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files", "first_seen_at": "2026-11-12T07:39:36+00:00", "cites": ["https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files"]}]
exploit_sources: []
---

# Microchip TimePictra: hard-coded root password in installation files exposes admin access

Link for people: https://infrastack.ai/live/CVE-2026-8332 (this .md is for agents)

Microchip's TimePictra platform ships installation files containing a hard-coded root password. Anyone who obtains those files can log in with privileged root credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TimePictra affected < 12.0 fixed 12.0

## How to check

Check the installed TimePictra platform version; anything before 12.0 is affected. Check who can read the TimePictra installation files/RPMs (file shares, backups, artifact repos, deployment hosts). If you can't upgrade yet, restrict access to those files and rotate or change the root password on installed systems (rotation is our suggestion; Microchip's advisory states only the upgrade).

## Fix

Upgrade TimePictra platform to 12.0 or later; its RPM installation files no longer expose the root password.

## Timeline

- 2026-11-12T07:37:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8332
- 2026-11-12T07:39:36+00:00 analyst https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files — Read Microchip PSIRT-138: affected before 12.0, fixed in 12.0 (RPM installs no longer expose root password). No exploitation or PoC found.

## Documents

- [advisory] PSIRT-138: TimePictra Platform Root Password Hardcoded in Installation Files https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-root-password-hardcoded-in-installation-files

## From the sources

A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_