Which versions of EcoStruxure Foxboro DCS are affected by CVE-2026-1286?

Schneider Electric EcoStruxure Foxboro DCS Control Software contains a remote code execution vulnerability affecting organizations operating Foxboro distributed control systems; administrators who…

How to fix or mitigate CVE-2026-1286?

Within 24 hours: inventory Foxboro DCS installations and notify all administrators of the vulnerability; implement access controls restricting project file opening to verified, trusted sources only, and prohibit file sharing from external or untrusted channels. Within 7 days: enable file integrity monitoring and detailed logging on all Foxboro project file access and modifications; implement role-based access controls limiting project file write permissions to designated engineering staff. Within 30 days: establish continuous monitoring of Schneider Electric security advisories for patch releases; evaluate technical isolation of engineering workstations through network segmentation; conduct security awareness training for administrators on file-based attack vectors; and develop and test incident response procedures specific to Foxboro DCS compromise scenarios.

EcoStruxure Foxboro DCS CVE-2026-1286

Q: What is the CVSS score of CVE-2026-1286?

CVE-2026-1286 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-10 cybersecurity@se.com

Deserialization RCE Ecostruxure Foxboro Dcs Control Software

7.0

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Local project-file trigger and admin-only use give AV:L and PR:H; victim must open the file (UI:R); deserialization yields full RCE, so C/I/A:H with unchanged scope.

3.1 AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (se).

CVSS VectorVendor: se

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 24, 2026 - 15:37 NVD

7.0 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 cve.org

HIGH 7.0

CVE Published

Mar 10, 2026 - 18:18 nvd

N/A

DescriptionCVE.org

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.

AnalysisAI

Remote code execution in Schneider Electric EcoStruxure Foxboro DCS Control Software allows a locally authenticated administrator to compromise the engineering workstation by opening a maliciously crafted project file, which triggers unsafe deserialization (CWE-502) leading to loss of confidentiality, integrity, and availability. The flaw affects operators of Foxboro distributed control systems and requires the victim to open the attacker-supplied file. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.22% 30-day exploitation probability, consistent with a high-privilege, local, user-interaction-dependent issue rather than a mass-exploitable one.

Technical ContextAI

The root cause is CWE-502, deserialization of untrusted data: the Foxboro DCS Control Software reconstructs application objects from a project file without validating that the serialized stream is safe, allowing an attacker to embed a gadget chain that executes code during or after deserialization. The affected component is identified by CPE cpe:2.3:a:schneider-electric:ecostruxure_foxboro_dcs_control_software, an engineering/configuration software used to build and manage Foxboro distributed control systems in industrial process environments. Because project files are a normal, trusted work artifact in DCS engineering workflows, the deserialization sink is reachable through routine operator actions rather than through an exposed network service.

RemediationAI

Apply the fix described in Schneider Electric security notice SEVD-2026-069-03 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-03.pdf); a patch is available per the vendor advisory, but no exact fixed version is provided in the source data, so confirm the precise release from that notice before scheduling the DCS maintenance window. Until patched, restrict engineering-workstation project files to trusted, integrity-verified sources and prohibit opening project files received via email, removable media, or untrusted network shares (trade-off: added friction to legitimate engineering collaboration). Limit and audit the set of admin-authenticated users who can run the Control Software, apply application allowlisting on the engineering workstations, and keep those hosts off general-purpose networks (trade-off: tighter change-control overhead). These OT-appropriate compensating controls reduce the chance a malicious project file reaches a privileged operator.