EUVD-2026-50297
GHSA-x32m-hcm8-8xv9
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local high-privilege attacker abusing stored credentials gives AV:L/PR:H; AC:H per vendor vector; scope change (S:C) reflects compromise of managed devices with full C/I/A impact.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
Lifecycle Timeline
2DescriptionCVE.org
CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, when a local privileged attacker leverages weaknesses in the handling and protection of stored credentials within the application.
AnalysisAI
Local privilege escalation and authentication bypass in Schneider Electric EcoStruxure Cybersecurity Admin Expert allows a local, high-privileged attacker to abuse weak protection of stored credentials (CWE-522) to modify credentials without authorization and bypass authentication, potentially pivoting to compromise the OT/industrial devices the tool manages. Schneider Electric published security notice SEVD-2026-195-02, and the CVSS 4.0 base score is 8.7 (High) with a scope change into subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
EcoStruxure Cybersecurity Admin Expert is Schneider Electric's administration application for provisioning and managing security credentials and policies across OT/industrial devices (CPE cpe:2.3:a:schneider_electric:ecostruxure™_cybersecurity_admin_expert). The root cause is CWE-522 (Insufficiently Protected Credentials): credentials the application stores are not adequately protected at rest - through weak encryption, recoverable storage, or insufficient access control - so an actor already on the host with sufficient privilege can read and alter them. Because those credentials govern access to managed field devices, weakening their protection lets an attacker forge or modify authentication material, which is why the CVSS vector marks both authentication bypass and a scope change (SC/SI/SA:H) reaching downstream systems.
RemediationAI
Apply the remediation in Schneider Electric security notice SEVD-2026-195-02 (https://download.se.com/files?p_Doc_Ref=SEVD-2026-195-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-195-02.pdf); the exact fixed version is not present in the input data and must be taken from that advisory. Because exploitation requires local high privilege, the most effective compensating controls are host-level: restrict interactive and administrative logon on the machine running Cybersecurity Admin Expert to a minimal set of vetted operators, enforce least privilege so day-to-day users are not local administrators, and audit access to the credential store files (trade-off: tighter access may slow legitimate multi-operator workflows). Isolate the admin workstation on a segmented OT management network and disable remote or shared access to it where feasible; where credentials cannot yet be re-protected by a patch, rotate the managed-device credentials after patching, since pre-patch stored secrets may already be recoverable by any local privileged user.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today