14
CVEs
1
Critical
8
High
0
KEV
0
PoC
9
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
8
MEDIUM
5
LOW
0
Monthly CVE Trend
Affected Products (30)
Struxureware Data Center Expert
46
Java
32
Interactive Graphical Scada System
32
Enterprise Linux Workstation
31
Enterprise Linux Server
31
Enterprise Linux Desktop
30
Ubuntu Linux
28
Debian Linux
28
Enterprise Linux Server Tus
27
Modicon M580 Firmware
27
Enterprise Linux Server Aus
27
Enterprise Linux Server Eus
27
Jre
27
Jdk
27
Xp7 Command View
26
Modicon M340 Firmware
25
Modicon M340 Bmxp342020 Firmware
25
Satellite
24
U Motion Builder
23
Modicon M340 Bmxp341000 Firmware
21
Modicon M340 Bmxp3420302 Firmware
20
140Cpu65150 Firmware
20
Modicon M340 Bmxp342000 Firmware
19
Modicon M340 Bmxp3420102 Firmware
19
Ecostruxure Control Expert
19
Jrockit
19
Easergy T300 Firmware
19
Modicon M340 Bmxp3420102Cl Firmware
16
Xp Command View
16
Xp P9000 Command View
16
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-9717 | Authenticated command injection in Schneider Electric PowerLogic P7 power metering devices allows a privileged user to execute arbitrary OS commands with elevated privileges over a network-exposed service, fully compromising device integrity, confidentiality, and availability. The flaw (CWE-78) stems from improper neutralization of special elements passed to an underlying OS command. No public exploit identified at time of analysis, and the device is not listed in CISA KEV; EPSS data was not provided. | HIGH | 8.6 | 1.0% | 54 |
No patch
|
| CVE-2026-9716 | Denial-of-service in Schneider Electric PowerLogic P7 power metering devices allows remote, unauthenticated attackers to crash the device's HMI and configuration functionality by sending malformed requests to exposed network interfaces. The flaw stems from a NULL pointer dereference (CWE-476) that renders local management and configuration unavailable until recovery. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 4.0 base score of 8.7 reflects a high availability impact with no confidentiality or integrity exposure. | HIGH | 8.7 | 0.3% | 54 |
No patch
|
| CVE-2026-9650 | Credential exposure in Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units & Controllers allows an unauthenticated attacker to recover credentials that are insufficiently protected within device firmware or system files (CWE-522). The recovered credentials can then be used to fully compromise the device when the attacker also has physical access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; vendor advisory SEVD-2026-160-02 covers the affected OT products. | HIGH | 8.7 | 0.2% | 54 |
No patch
|
| CVE-2026-3869 | Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.2 | 0.5% | 46 |
No patch
|
| CVE-2026-9718 | Denial-of-service in Schneider Electric PowerLogic P7 power monitoring devices allows an authenticated attacker to crash a network-exposed service by sending a specially crafted request that triggers a reachable assertion (CWE-617), fully disrupting availability. The CVSS 4.0 score of 6.9 reflects the high-privilege prerequisite (PR:H) that constrains exploitation to actors with administrative credentials, while the availability impact is rated high (VA:H) with no confidentiality or integrity consequences. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis. | MEDIUM | 6.9 | 0.2% | 45 |
No patch
|
| CVE-2026-14354 | Local privilege escalation and authentication bypass in Schneider Electric EcoStruxure Cybersecurity Admin Expert allows a local, high-privileged attacker to abuse weak protection of stored credentials (CWE-522) to modify credentials without authorization and bypass authentication, potentially pivoting to compromise the OT/industrial devices the tool manages. Schneider Electric published security notice SEVD-2026-195-02, and the CVSS 4.0 base score is 8.7 (High) with a scope change into subsequent systems. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 8.7 | 0.1% | 44 |
No patch
|
| CVE-2026-9651 | Incorrect file permission assignment on Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units exposes password hashes stored in system files to unauthorized reading by privileged local users. An attacker who has already obtained privileged local access to the RTU can read these improperly protected files, extract credential hashes, and perform offline cracking to achieve account compromise. No public exploit code exists at time of analysis, and the vulnerability has not been listed in CISA KEV, but the high confidentiality impact on credential material in OT/ICS environments warrants attention. | MEDIUM | 6.7 | 0.1% | 44 |
No patch
|
| CVE-2026-77120 | Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context. | HIGH | 8.7 | 0.4% | 44 |
No patch
|
| CVE-2026-19233 | Server-Side Request Forgery in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior enables a privileged authenticated attacker to send crafted, unvalidated parameters to a server endpoint, causing the platform to make unauthorized outbound or internal requests. The resulting impact spans unauthorized command execution and disclosure of server-side data - a unusually severe outcome for SSRF, likely achieved by pivoting through the SSRF to reach privileged internal services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.6 | 0.7% | 43 |
No patch
|
| CVE-2026-8044 | Remote code execution is possible in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior via an argument injection flaw (CWE-88) in backup configuration parameter handling. An attacker holding a privileged account can supply crafted arguments that are passed unsanitized to an underlying backup command, resulting in arbitrary OS-level code execution on the server. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack vector and full CIA impact make this a meaningful risk for any organization operating this data center infrastructure management platform. | HIGH | 8.6 | 0.4% | 43 |
No patch
|
| CVE-2026-13336 | OS command injection in Schneider Electric NetBotz 5 (models 750 and 755) environmental monitoring appliances allows arbitrary Linux OS command execution when a system backup that has been maliciously modified is restored on the device. Exploitation requires high-privilege administrative access and adjacent network positioning, substantially narrowing the realistic threat population to insiders or supply-chain compromise scenarios. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 7.3 | 0.6% | 36 |
No patch
|
| CVE-2026-13348 | Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. | MEDIUM | 6.9 | 0.3% | 34 |
No patch
|
| CVE-2026-81861 | Credential interception vulnerability in Schneider Electric SCADAPack RTUs (Remote Terminal Units) exposes authentication information over the network, enabling unauthorized access to RTU functionality. Affected products span the SCADAPack 3xx, 32, 47x/470R, and 57x families - all version ranges per CPE wildcards - used extensively in critical infrastructure sectors such as oil and gas pipelines, water systems, and electrical utilities. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation yields full credential disclosure and subsequent unauthorized control of industrial RTU assets. | MEDIUM | 5.9 | 0.4% | 30 |
No patch
|
| CVE-2026-13337 | HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 5.1 | 0.2% | 26 |
No patch
|