Which versions of EcoStruxure Automation Expert are affected by CVE-2026-2273?

Schneider Electric EcoStruxure Automation Expert is vulnerable to code injection (CVE-2026-2273, CVSS 7.2) that could allow authenticated users to execute arbitrary commands on engineering…

How to fix or mitigate CVE-2026-2273?

Within 24 hours, inventory all EcoStruxure Automation Expert installations and communicate the social-engineering risk to engineering and operations teams; implement email gateway and file-transfer controls to restrict untrusted project files. Within 7 days, deploy or configure endpoint detection and response (EDR) tools to monitor process execution initiated by EcoStruxure, and apply principle-of-least-privilege restrictions to engineering workstations to contain potential lateral movement. Within 30 days, establish application whitelisting policies on engineering systems, require digital signatures or cryptographic verification for project file distribution, implement network segmentation isolating engineering workstations from operational technology infrastructure, and conduct targeted security awareness training for staff handling project files; continue monitoring Schneider Electric advisories for patch availability.

EcoStruxure Automation Expert CVE-2026-2273

Q: What is the CVSS score of CVE-2026-2273?

CVE-2026-2273 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Code Injection (CWE-94)

2026-03-10 cybersecurity@se.com

RCE Code Injection Schneider Electric Ecostruxure Automation Expert

7.2

CVSS 4.0 · Vendor: se

Severity by source

Vendor (se) PRIMARY

7.2 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Local file-open attack by a low-privileged authenticated user requiring interaction (AV:L/PR:L/UI:R); scope changes as the compromised workstation impacts subsequent OT systems (S:C), with high integrity but limited confidentiality/availability impact.

3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H

Primary rating from Vendor (se).

CVSS VectorVendor: se

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 23, 2026 - 14:37 NVD

7.2 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 cve.org

HIGH 7.2

CVE Published

Mar 10, 2026 - 18:18 nvd

N/A

DescriptionCVE.org

CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exist that could cause execution of untrusted commands on the engineering workstation which could result in a limited compromise of the workstation and a potential loss of Confidentiality, Integrity and Availability of the subsequent system when an authenticated user opens a malicious project file.

AnalysisAI

Code injection (CWE-94) in Schneider Electric EcoStruxure Automation Expert allows an authenticated user who opens a malicious project file to execute untrusted commands on the engineering workstation, resulting in limited compromise and potential loss of confidentiality, integrity, and availability of subsequent systems. Exploitation requires local access, low-level privileges, and victim interaction (opening the crafted file), so it is a social-engineering-driven local RCE rather than a remote network attack. There is no public exploit identified at time of analysis and the EPSS score is very low (0.02%, 6th percentile), indicating minimal expectation of widespread exploitation.

Technical ContextAI

EcoStruxure Automation Expert is Schneider Electric's IEC 61499-based open automation platform used to engineer and orchestrate industrial control applications (OT/ICS environments). The flaw is a CWE-94 Improper Control of Generation of Code issue: the engineering software processes project files that can embed code or command constructs which are interpreted and executed rather than treated purely as data. When a maliciously crafted project file is loaded, attacker-controlled content is evaluated in the context of the engineering workstation, allowing arbitrary command execution. The single affected product per CPE is cpe:2.3:a:schneider-electric:ecostruxure_automation_expert (version wildcard, so no upper/lower bound is encoded in the CPE).

RemediationAI

Apply the remediation described in Schneider Electric Security Notification SEVD-2026-069-04 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf); a patch is available per this vendor advisory, but no exact fixed version string is present in the supplied data, so operators must read the notice to obtain the precise remediated build. Until the update is deployed, the most effective compensating control is to treat project files as untrusted input: only open EcoStruxure Automation Expert project files received from verified, trusted sources and validate their origin/integrity before loading, since exploitation strictly requires a user to open a malicious file. Additional hardening includes restricting engineering-workstation access to authorized personnel only, running the engineering software under least-privilege accounts, isolating engineering workstations from general IT networks and the internet, and applying file-transfer controls so attacker-supplied project files cannot easily reach operators - trade-offs are mainly workflow friction when exchanging projects with integrators or partners.