Which versions of Ecostruxure Power Operation are affected by CVE-2025-11739?

Schneider Electric's EcoStruxure Power Monitoring Expert and Power Operations platforms (versions 2022-2024 R2) contain a privilege escalation vulnerability allowing locally authenticated users to…

How to fix or mitigate CVE-2025-11739?

Within 24 hours, inventory all systems running EcoStruxure Power Monitoring Expert (2022-2024 R2) or EcoStruxure Power Operations (2022, 2024), document all local user accounts with access, and verify audit logging is enabled on affected systems. Within 7 days, restrict local administrative access to essential personnel only, revoke unnecessary privileges from local accounts, and implement network segmentation to isolate power management infrastructure from general corporate networks where operationally feasible. Within 30 days, monitor Schneider Electric security advisories and vendor channels for patch releases, and apply any available patches immediately; simultaneously engage vendor support to request interim hardening guidance or workarounds for production systems.

Ecostruxure Power Operation CVE-2025-11739

Q: What is the CVSS score of CVE-2025-11739?

CVE-2025-11739 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-10 cybersecurity@se.com

RCE Deserialization Schneider Electric Ecostruxure Power Operation Ecostruxure Power Monitoring Expert

8.5

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (se) · only source for this CVE.

CVSS VectorVendor: se

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 24, 2026 - 19:22 NVD

8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:17 nvd

N/A

CVE Published

Mar 10, 2026 - 18:17 cve.org

HIGH 8.5

DescriptionCVE.org

CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.

AnalysisAI

Arbitrary code execution with administrative privileges in Schneider Electric EcoStruxure Power Monitoring Expert (2022 through 2024 R2) and EcoStruxure Power Operation (2022, 2024) allows a locally authenticated attacker to run code by sending a crafted data stream that triggers unsafe object deserialization (CWE-502). Authentication is required (CVSS 4.0 PR:L) and the vector is local, but successful exploitation fully compromises the host with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.07%, 20th percentile).