Which versions of Schneider Electric device are affected by CVE-2026-0667?

A critical remote code execution vulnerability (CVE-2026-0667, CVSS 9.3) in Schneider Electric industrial control systems allows unauthenticated attackers to compromise or disable production…

How to fix or mitigate CVE-2026-0667?

Within 24 hours, identify and isolate all affected Schneider Electric industrial systems on network diagrams, implement firewall rules to restrict Modbus TCP (port 502) access to only authorized engineering workstations or control networks, and deploy IDS/IPS signatures for Modbus protocol anomalies. Within 7 days, complete a full inventory of exposed systems, assess criticality and operational impact, and establish 24/7 monitoring for suspicious Modbus communications. Within 30 days, contact Schneider Electric for patch availability and timelines, evaluate air-gapping or segmentation strategies for highest-risk systems, and document all compensating controls in your OT security baseline until a vendor patch is available.

Schneider Electric device CVE-2026-0667

Q: What is the CVSS score of CVE-2026-0667?

CVE-2026-0667 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-50303 CRITICAL

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-07-29 cybersecurity@se.com

GHSA-q9ph-762q-r4c6

RCE Denial Of Service

9.3

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Network-reachable Modbus TCP flaw with no authentication or interaction (AV:N/AC:L/PR:N/UI:N) yielding code execution and DoS, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (se).

CVSS VectorVendor: se

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 13:31 vuln.today

CVE Published

Jul 29, 2026 - 13:17 cve.org

CRITICAL 9.3

DescriptionCVE.org

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.

AnalysisAI

Remote code execution, denial of service, and data compromise affect a Schneider Electric industrial product exposing a Modbus TCP interface, where improper handling of unusual or exceptional Modbus conditions (CWE-754) lets a network attacker crash the device or run arbitrary code. The CVSS 4.0 base score of 9.3 with a network, no-privilege, no-interaction vector indicates unauthenticated remote exploitation is feasible. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of protocol exposure and full confidentiality/integrity/availability impact makes it a serious OT concern.

Technical ContextAI

Modbus TCP is a widely used industrial control protocol that encapsulates the legacy Modbus application layer over TCP port 502, typically without built-in authentication or integrity protection. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): the affected Schneider Electric device fails to validate or gracefully handle malformed, out-of-range, or unexpected Modbus TCP requests, so exceptional protocol states are not caught and instead corrupt program flow. Because Modbus TCP endpoints on PLCs, RTUs, and controllers are commonly reachable across flat OT networks, an unchecked exceptional condition in the protocol parser can escalate from a parsing error into memory corruption and code execution. The exact affected model is not specified in the provided data; the CPE list was not supplied.

RemediationAI

Consult Schneider Electric Security and Safety Notice SEVD-2026-041-01 (https://download.se.com/files?p_Doc_Ref=SEVD-2026-041-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-01.pdf) and apply the fixed firmware/version it specifies; the exact patched version is not present in the provided data, so extract it from that advisory before deployment. Where patching is not immediately possible on production OT assets, restrict access to TCP port 502 so that only authorized engineering workstations and SCADA hosts can reach the device, place the device behind an industrial firewall or Modbus-aware IPS, and enforce strict network segmentation between IT and OT zones - accepting the side effect that legitimate remote Modbus polling paths may need reconfiguration. Disable or block external/untrusted Modbus TCP connectivity entirely if the interface is not operationally required, noting this will break any integrations that rely on it, and monitor Modbus traffic for malformed or anomalous requests.