27
CVEs
1
Critical
12
High
0
KEV
0
PoC
13
Unpatched C/H
7.4%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
12
MEDIUM
13
LOW
1
Monthly CVE Trend
Affected Products (30)
Struxureware Data Center Expert
46
Java
32
Interactive Graphical Scada System
32
Enterprise Linux Workstation
31
Enterprise Linux Server
31
Enterprise Linux Desktop
30
Ubuntu Linux
28
Debian Linux
28
Enterprise Linux Server Tus
27
Modicon M580 Firmware
27
Enterprise Linux Server Aus
27
Enterprise Linux Server Eus
27
Jre
27
Jdk
27
Xp7 Command View
26
Modicon M340 Firmware
25
Modicon M340 Bmxp342020 Firmware
25
Satellite
24
U Motion Builder
23
Modicon M340 Bmxp341000 Firmware
21
Modicon M340 Bmxp3420302 Firmware
20
140Cpu65150 Firmware
20
Modicon M340 Bmxp342000 Firmware
19
Modicon M340 Bmxp3420102 Firmware
19
Ecostruxure Control Expert
19
Jrockit
19
Easergy T300 Firmware
19
Modicon M340 Bmxp3420102Cl Firmware
16
Xp Command View
16
Xp P9000 Command View
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9717 | Authenticated command injection in Schneider Electric PowerLogic P7 power metering devices allows a privileged user to execute arbitrary OS commands with elevated privileges over a network-exposed service, fully compromising device integrity, confidentiality, and availability. The flaw (CWE-78) stems from improper neutralization of special elements passed to an underlying OS command. No public exploit identified at time of analysis, and the device is not listed in CISA KEV; EPSS data was not provided. | HIGH | 8.6 | 1.0% | 54 |
No patch
|
| CVE-2026-9716 | Denial-of-service in Schneider Electric PowerLogic P7 power metering devices allows remote, unauthenticated attackers to crash the device's HMI and configuration functionality by sending malformed requests to exposed network interfaces. The flaw stems from a NULL pointer dereference (CWE-476) that renders local management and configuration unavailable until recovery. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 4.0 base score of 8.7 reflects a high availability impact with no confidentiality or integrity exposure. | HIGH | 8.7 | 0.3% | 54 |
No patch
|
| CVE-2026-9650 | Credential exposure in Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units & Controllers allows an unauthenticated attacker to recover credentials that are insufficiently protected within device firmware or system files (CWE-522). The recovered credentials can then be used to fully compromise the device when the attacker also has physical access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; vendor advisory SEVD-2026-160-02 covers the affected OT products. | HIGH | 8.7 | 0.2% | 54 |
No patch
|
| CVE-2026-6866 | Schneider Electric EcoStruxure Panel Server can revert credentials to insecure default values under rare circumstances, allowing remote unauthenticated attackers to gain unauthorized access using known factory credentials. This CWE-1188 vulnerability enables complete confidential information disclosure (CVSS 8.2 High). Exploitation requires specific timing conditions (AT:P - Attack Timing: Present) to catch the window when credentials reset. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting targeted rather than widespread exploitation risk. | HIGH | 8.2 | 0.1% | 51 |
No patch
|
| CVE-2026-3869 | Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.5% | 46 |
No patch
|
| CVE-2026-8045 | Server-side file disclosure in Schneider Electric EcoStruxure IT Data Center Expert v9.1.1 and prior allows authenticated users to read arbitrary files on the underlying host by submitting crafted XML payloads to SOAP service endpoints. The flaw stems from improper restriction of XML External Entity references (CWE-611) in the SOAP API. No public exploit identified at time of analysis, but CISA SSVC marks the issue as automatable with partial technical impact. | HIGH | 7.1 | 0.1% | 46 |
No patch
|
| CVE-2026-6865 | Unauthorized file disclosure in Schneider Electric Saitel DP and EasyLogic T150 (formerly Saitel DR) Remote Terminal Units lets a low-privileged remote attacker read sensitive files outside intended directories via improper server-side file path handling. The advisory tagging also associates the flaw with an authentication-bypass angle, and the primary impact is confidentiality of files on the affected OT/ICS controllers. There is no public exploit identified at time of analysis, EPSS risk is very low (0.06%, 17th percentile), and CISA SSVC rates exploitation as none. | HIGH | 7.1 | 0.1% | 46 |
No patch
|
| CVE-2026-9718 | Denial-of-service in Schneider Electric PowerLogic P7 power monitoring devices allows an authenticated attacker to crash a network-exposed service by sending a specially crafted request that triggers a reachable assertion (CWE-617), fully disrupting availability. The CVSS 4.0 score of 6.9 reflects the high-privilege prerequisite (PR:H) that constrains exploitation to actors with administrative credentials, while the availability impact is rated high (VA:H) with no confidentiality or integrity consequences. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis. | MEDIUM | 6.9 | 0.2% | 45 |
No patch
|
| CVE-2026-14354 | Local privilege escalation and authentication bypass in Schneider Electric EcoStruxure Cybersecurity Admin Expert allows a local, high-privileged attacker to abuse weak protection of stored credentials (CWE-522) to modify credentials without authorization and bypass authentication, potentially pivoting to compromise the OT/industrial devices the tool manages. Schneider Electric published security notice SEVD-2026-195-02, and the CVSS 4.0 base score is 8.7 (High) with a scope change into subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.7 | 0.1% | 44 |
No patch
|
| CVE-2026-9651 | Incorrect file permission assignment on Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units exposes password hashes stored in system files to unauthorized reading by privileged local users. An attacker who has already obtained privileged local access to the RTU can read these improperly protected files, extract credential hashes, and perform offline cracking to achieve account compromise. No public exploit code exists at time of analysis, and the vulnerability has not been listed in CISA KEV, but the high confidentiality impact on credential material in OT/ICS environments warrants attention. | MEDIUM | 6.7 | 0.1% | 44 |
No patch
|
| CVE-2026-4827 | Weak session token generation in Schneider Electric industrial protection relays and energy management systems allows remote attackers to hijack authenticated user sessions via network-based prediction attacks. Affects 36 product variants across Easergy MiCOM P30/P40/C264, PowerLogic P5/P7/T-series, EcoStruxure Power Automation/Operation platforms, and iPMFLS systems. CVSS 8.7 reflects high confidentiality and integrity impact with user interaction required. No active exploitation confirmed (not in CISA KEV), but authentication bypass via session prediction enables privilege escalation in critical infrastructure environments. EPSS data not provided - risk assessment relies on CVSS vector and operational technology context. | HIGH | 8.7 | 0.1% | 44 |
No patch
|
| CVE-2026-77120 | Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-19233 | Server-Side Request Forgery in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior enables a privileged authenticated attacker to send crafted, unvalidated parameters to a server endpoint, causing the platform to make unauthorized outbound or internal requests. The resulting impact spans unauthorized command execution and disclosure of server-side data - a unusually severe outcome for SSRF, likely achieved by pivoting through the SSRF to reach privileged internal services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.6 | 0.7% | 43 |
No patch
|
| CVE-2026-8044 | Remote code execution is possible in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior via an argument injection flaw (CWE-88) in backup configuration parameter handling. An attacker holding a privileged account can supply crafted arguments that are passed unsanitized to an underlying backup command, resulting in arbitrary OS-level code execution on the server. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack vector and full CIA impact make this a meaningful risk for any organization operating this data center infrastructure management platform. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-13336 | OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.3 | 0.6% | 36 |
No patch
|