Introduction:
TimePictra is a comprehensive,web-based management software suite developed by Microchip Technology tomonitor, manage, and secure critical timing infrastructure, particularly thoserelying on GNSS signals. It is designed to provide centralized, real-timevisibility into synchronization networks, aiding in the detection of spoofingor jamming attacks.
During a security engagement, Steve NyanLin discovered a stored XSS vulnerability in the TimePictra web application whichwas due to a lack of input filtering. This affects the neName parameterwhen creating new network elements.
The vulnerability affects TimePictraversions 11.0 through 11.3 SP2 , was assignedCVE-2026-3010 and has a CVSS score of9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N).
This post outlines the technical details ofthis vulnerability, how it can be exploited, and the potential impact to users.At the time of writing, Microchip has not released a patch for this issue orany recommended mitigation steps.
The Vulnerability:
An attacker could chain (CVE-2026-2844,also disclosed by Bastion Security) to steal a valid TimePictra user’s sessioncookie to take over their account. They could perform authenticated actionssuch as making changes to network devices which may affecttheir availability forlegitimate users. This in turn has the potential to disrupt businessoperations.
The screenshot below shows the XSS payloadbeing triggered when a user visits the homepage of the TimePictra application:
Recommendation:
Monitor the Microchip website for officialpatch availability and remediation guidance.
Implement IP-based access control lists torestrict access to the TimePictra management interface.
Disclosure Timeline:
February 5th, 2026: Issue reported to the TimePictra Security Team (PSIRT)
February 5th, 2026: Issue acknowledged and PSIRT-124 assigned
March 1st, 2026: CVE-2026-3010 assigned
April 3rd, 2026: Advisory Live