Is there a patch available for CVE-2026-2404?

Yes, a patch is available for CVE-2026-2404. Update the affected software to the latest version immediately.

Powerchute Serial Shutdown CVE-2026-2404

Q: What is the CVSS score of CVE-2026-2404?

CVE-2026-2404 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22292 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-04-14 schneider

GHSA-cjw8-79x6-5cj4

GHSA-vm32-vv63-w422

GHSA-vx8h-6mfq-gv3p

Code Injection Powerchute Serial Shutdown

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 14, 2026 - 20:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 17:04 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

6.9 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22292

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 15:13 nvd

MEDIUM 6.9

DescriptionCVE.org

CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security check request payload.

AnalysisAI

Log injection via improper output encoding in Schneider Electric PowerChute™ Serial Shutdown allows unauthenticated remote attackers to forge or inject malicious log entries by sending crafted POST requests to the /j_security_check endpoint, potentially obscuring attack trails or triggering false alerts.

Technical ContextAI

CWE-116 (Improper Encoding or Escaping of Output) occurs when user-supplied input is logged without proper sanitization or encoding. In this case, the /j_security_check endpoint in PowerChute™ Serial Shutdown processes POST request payloads and writes them to logs without neutralizing special characters or control sequences that have meaning in log formats. Attackers exploit this by injecting newline characters, log delimiters, or other sequences to create fake log entries that appear legitimate. The CPE cpe:2.3:a:schneider_electric:powerchute™_serial_shutdown:*:*:*:*:*:*:*:* indicates all versions of this product are affected.

RemediationAI

Apply the security update released by Schneider Electric as documented in SEVD-2026-104-01 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf). The patch corrects the output encoding in the /j_security_check request handler to prevent injection of special characters into logs. Until patching is possible, implement network-level controls to restrict access to the /j_security_check endpoint and monitor logs for suspicious entries containing unusual control characters or out-of-sequence log messages that may indicate injection attempts.