VertiGIS FM Critical Vulnerability - Remote Code Execution and XSS

CERT-Bund published security advisory WID-SEC-2026-0959 identifying multiple critical vulnerabilities in VertiGIS FM software versions below 10.11.363 and 10.13.403. The vulnerabilities have a CVSS Base Score of 9.9 (critical) and CVSS Temporal Score of 8.9 (high). Remote attackers who are authenticated can exploit these flaws to execute arbitrary code and perform cross-site scripting attacks.

Organizations using VertiGIS FM must immediately identify instances running affected versions and apply available patches or mitigations. Users should verify their systems are updated to version 10.11.363 or 10.13.403 and later. Given the critical severity and remote attack vector, priority patching is required to prevent potential compromise of building management systems.