Schneider Electric Security Notification · May 2026

    Schneider ElectricScheduled

    4

    Total

    Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.

    0

    Critical

    CVEs with CVSS 9.0 or higher (critical per NVD scale).

    0

    Zero-day

    Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).

    0

    KEV

    Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.

    By product family

    Unassigned4 CVEs
    Unassigned
    SeverityCVEDescriptionKB articleCVSS
    HighCVE-2026-4827

    CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

    		—8.7
    HighCVE-2026-6332

    CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.

    		—7.5
    HighCVE-2026-6866

    CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

    		—7.5
    HighCVE-2026-6865

    CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.

    		—7.1