Schneider Electric Security Notification · August 2026

    Schneider ElectricScheduled

    3

    Total

    Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.

    0

    Critical

    CVEs with CVSS 9.0 or higher (critical per NVD scale).

    0

    Zero-day

    Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).

    0

    KEV

    Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.

    By product family

    Unassigned3 CVEs
    Unassigned
    HighCVE-2026-13336

    CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified.

    		—7.3
    MediumCVE-2026-13348

    CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled.

    		—6.9
    MediumCVE-2026-13337

    CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui.

    		—5.1