Vulnerability intelligence

CVE-2026-4293

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.

CVSS Score

—

Medium

EPSS — Exploit Probability

0.3%

Riskier than 19% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry

1 article across 1 outlet · first covered May 19, 2026 · latest May 19, 2026

Coverage timeline

Kieback & Peter DDC Building Controllers
www.cisa.gov · May 19, 2026