---
id: CVE-2026-95649
title: >-
  IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary
  code execution
summary: |-
  IRISPowerscan insufficiently restrict the use of
  untrusted scripts. An authenticated user with access to script functionality
  can import or modify scripts that are executed by the application, potentially
  resulting in arbitrary code exec…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-829
vendor: I.R.I.S S.A.
product: IRISPowerscan
affected:
  - IRISPowerscan <= 12.3
published: '2026-11-04'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T09:14:14.423Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-95649'
references:
  - url: 'https://www.canon-europe.com/psirt/advisory-information'
tags:
  - cve.org
epss: 0.00208
epssPercentile: 0.10997
ingestedAt: '2026-11-05T20:33:06.725Z'
---

## Overview

IRISPowerscan insufficiently restrict the use of
untrusted scripts. An authenticated user with access to script functionality
can import or modify scripts that are executed by the application, potentially
resulting in arbitrary code execution in the security context of the Windows
user running IRISPowerscan.

## Affected

- `IRISPowerscan <= 12.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.