34
CVEs
1
Critical
17
High
0
KEV
0
PoC
18
Unpatched C/H
5.9%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
17
MEDIUM
15
LOW
1
Monthly CVE Trend
Affected Products (30)
Struxureware Data Center Expert
46
Java
32
Interactive Graphical Scada System
32
Enterprise Linux Workstation
31
Enterprise Linux Server
31
Enterprise Linux Desktop
30
Ubuntu Linux
28
Debian Linux
28
Enterprise Linux Server Tus
27
Modicon M580 Firmware
27
Enterprise Linux Server Aus
27
Enterprise Linux Server Eus
27
Jre
27
Jdk
27
Xp7 Command View
26
Modicon M340 Firmware
25
Modicon M340 Bmxp342020 Firmware
25
Satellite
24
U Motion Builder
23
Modicon M340 Bmxp341000 Firmware
21
Modicon M340 Bmxp3420302 Firmware
20
140Cpu65150 Firmware
20
Modicon M340 Bmxp342000 Firmware
19
Modicon M340 Bmxp3420102 Firmware
19
Ecostruxure Control Expert
19
Jrockit
19
Easergy T300 Firmware
19
Modicon M340 Bmxp3420102Cl Firmware
16
Xp Command View
16
Xp P9000 Command View
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9717 | Authenticated command injection in Schneider Electric PowerLogic P7 power metering devices allows a privileged user to execute arbitrary OS commands with elevated privileges over a network-exposed service, fully compromising device integrity, confidentiality, and availability. The flaw (CWE-78) stems from improper neutralization of special elements passed to an underlying OS command. No public exploit identified at time of analysis, and the device is not listed in CISA KEV; EPSS data was not provided. | HIGH | 8.6 | 1.0% | 54 |
No patch
|
| CVE-2026-9716 | Denial-of-service in Schneider Electric PowerLogic P7 power metering devices allows remote, unauthenticated attackers to crash the device's HMI and configuration functionality by sending malformed requests to exposed network interfaces. The flaw stems from a NULL pointer dereference (CWE-476) that renders local management and configuration unavailable until recovery. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 4.0 base score of 8.7 reflects a high availability impact with no confidentiality or integrity exposure. | HIGH | 8.7 | 0.3% | 54 |
No patch
|
| CVE-2026-9650 | Credential exposure in Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units & Controllers allows an unauthenticated attacker to recover credentials that are insufficiently protected within device firmware or system files (CWE-522). The recovered credentials can then be used to fully compromise the device when the attacker also has physical access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; vendor advisory SEVD-2026-160-02 covers the affected OT products. | HIGH | 8.7 | 0.2% | 54 |
No patch
|
| CVE-2025-11739 | Arbitrary code execution with administrative privileges in Schneider Electric EcoStruxure Power Monitoring Expert (2022 through 2024 R2) and EcoStruxure Power Operation (2022, 2024) allows a locally authenticated attacker to run code by sending a crafted data stream that triggers unsafe object deserialization (CWE-502). Authentication is required (CVSS 4.0 PR:L) and the vector is local, but successful exploitation fully compromises the host with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.07%, 20th percentile). | HIGH | 8.5 | 0.1% | 53 |
No patch
|
| CVE-2026-6866 | Schneider Electric EcoStruxure Panel Server can revert credentials to insecure default values under rare circumstances, allowing remote unauthenticated attackers to gain unauthorized access using known factory credentials. This CWE-1188 vulnerability enables complete confidential information disclosure (CVSS 8.2 High). Exploitation requires specific timing conditions (AT:P - Attack Timing: Present) to catch the window when credentials reset. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis, suggesting targeted rather than widespread exploitation risk. | HIGH | 8.2 | 0.1% | 51 |
No patch
|
| CVE-2026-2273 | Code injection (CWE-94) in Schneider Electric EcoStruxure Automation Expert allows an authenticated user who opens a malicious project file to execute untrusted commands on the engineering workstation, resulting in limited compromise and potential loss of confidentiality, integrity, and availability of subsequent systems. Exploitation requires local access, low-level privileges, and victim interaction (opening the crafted file), so it is a social-engineering-driven local RCE rather than a remote network attack. There is no public exploit identified at time of analysis and the EPSS score is very low (0.02%, 6th percentile), indicating minimal expectation of widespread exploitation. | HIGH | 7.2 | 0.0% | 46 |
No patch
|
| CVE-2026-3869 | Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.5% | 46 |
No patch
|
| CVE-2026-8045 | Server-side file disclosure in Schneider Electric EcoStruxure IT Data Center Expert v9.1.1 and prior allows authenticated users to read arbitrary files on the underlying host by submitting crafted XML payloads to SOAP service endpoints. The flaw stems from improper restriction of XML External Entity references (CWE-611) in the SOAP API. No public exploit identified at time of analysis, but CISA SSVC marks the issue as automatable with partial technical impact. | HIGH | 7.1 | 0.1% | 46 |
No patch
|
| CVE-2026-6865 | Unauthorized file disclosure in Schneider Electric Saitel DP and EasyLogic T150 (formerly Saitel DR) Remote Terminal Units lets a low-privileged remote attacker read sensitive files outside intended directories via improper server-side file path handling. The advisory tagging also associates the flaw with an authentication-bypass angle, and the primary impact is confidentiality of files on the affected OT/ICS controllers. There is no public exploit identified at time of analysis, EPSS risk is very low (0.06%, 17th percentile), and CISA SSVC rates exploitation as none. | HIGH | 7.1 | 0.1% | 46 |
No patch
|
| CVE-2026-1286 | Remote code execution in Schneider Electric EcoStruxure Foxboro DCS Control Software allows a locally authenticated administrator to compromise the engineering workstation by opening a maliciously crafted project file, which triggers unsafe deserialization (CWE-502) leading to loss of confidentiality, integrity, and availability. The flaw affects operators of Foxboro distributed control systems and requires the victim to open the attacker-supplied file. There is no public exploit identified at time of analysis, and EPSS estimates only a 0.22% 30-day exploitation probability, consistent with a high-privilege, local, user-interaction-dependent issue rather than a mass-exploitable one. | HIGH | 7.0 | 0.2% | 45 |
No patch
|
| CVE-2026-9718 | Denial-of-service in Schneider Electric PowerLogic P7 power monitoring devices allows an authenticated attacker to crash a network-exposed service by sending a specially crafted request that triggers a reachable assertion (CWE-617), fully disrupting availability. The CVSS 4.0 score of 6.9 reflects the high-privilege prerequisite (PR:H) that constrains exploitation to actors with administrative credentials, while the availability impact is rated high (VA:H) with no confidentiality or integrity consequences. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis. | MEDIUM | 6.9 | 0.2% | 45 |
No patch
|
| CVE-2025-13901 | Partial Denial of Service against Schneider Electric Modicon M241, M251, and M262 programmable logic controllers (PLCs) is achievable by unauthenticated remote attackers via the Machine Expert programming protocol. Exploitation requires only network reachability to the affected PLC - no credentials or user interaction - allowing an attacker to send malformed payloads that exhaust active communication channels through improper resource release (CWE-404). No public exploit code exists and EPSS is very low (0.05%), but the network-accessible attack surface with zero authentication in OT environments elevates operational risk beyond the Medium CVSS rating suggests. | MEDIUM | 6.9 | 0.1% | 45 |
No patch
|
| CVE-2026-14354 | Local privilege escalation and authentication bypass in Schneider Electric EcoStruxure Cybersecurity Admin Expert allows a local, high-privileged attacker to abuse weak protection of stored credentials (CWE-522) to modify credentials without authorization and bypass authentication, potentially pivoting to compromise the OT/industrial devices the tool manages. Schneider Electric published security notice SEVD-2026-195-02, and the CVSS 4.0 base score is 8.7 (High) with a scope change into subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.7 | 0.1% | 44 |
No patch
|
| CVE-2026-9651 | Incorrect file permission assignment on Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units exposes password hashes stored in system files to unauthorized reading by privileged local users. An attacker who has already obtained privileged local access to the RTU can read these improperly protected files, extract credential hashes, and perform offline cracking to achieve account compromise. No public exploit code exists at time of analysis, and the vulnerability has not been listed in CISA KEV, but the high confidentiality impact on credential material in OT/ICS environments warrants attention. | MEDIUM | 6.7 | 0.1% | 44 |
No patch
|
| CVE-2026-4827 | Weak session token generation in Schneider Electric industrial protection relays and energy management systems allows remote attackers to hijack authenticated user sessions via network-based prediction attacks. Affects 36 product variants across Easergy MiCOM P30/P40/C264, PowerLogic P5/P7/T-series, EcoStruxure Power Automation/Operation platforms, and iPMFLS systems. CVSS 8.7 reflects high confidentiality and integrity impact with user interaction required. No active exploitation confirmed (not in CISA KEV), but authentication bypass via session prediction enables privilege escalation in critical infrastructure environments. EPSS data not provided - risk assessment relies on CVSS vector and operational technology context. | HIGH | 8.7 | 0.1% | 44 |
No patch
|