---
id: "CVE-2026-95649"
kind: "vulnerability"
aliases: ["CVE-2026-95649"]
title: "IRISPowerscan: untrusted scripts can run code as the Windows user"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["irispowerscan", "other", "windows"]
not_affected_if: ["auth-required"]
published_at: "2026-11-04T10:17:27+00:00"
first_seen_at: "2026-11-04T10:26:35+00:00"
updated_at: "2026-11-04T10:27:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95649", "first_seen_at": "2026-11-04T10:26:35+00:00"}]
---

# IRISPowerscan: untrusted scripts can run code as the Windows user

IRISPowerscan does not restrict which scripts it runs, so a logged-in user who can import or edit scripts can have the application execute their code. The code runs with the security context of the Windows user running IRISPowerscan.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-04T10:26:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95649

## From the sources

IRISPowerscan insufficiently restrict the use of
untrusted scripts. An authenticated user with access to script functionality
can import or modify scripts that are executed by the application, potentially
resulting in arbitrary code execution in the security context of the Windows
user running IRISPowerscan.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_