Schneider Electric Security Notification · September 2026

    Schneider ElectricScheduled

    5

    Total

    Deduplicated CVEs in this cycle. For Microsoft, only CVEs first published on Patch Tuesday itself count, excluding browser updates, late additions and cloud fixes.

    1

    Critical

    CVEs with CVSS 9.0 or higher (critical per NVD scale).

    0

    Zero-day

    Actively exploited at time of disclosure (CISA KEV or vendor-confirmed).

    0

    KEV

    Listed in CISA's Known Exploited Vulnerabilities catalog: mandatory for US agencies, best practice for everyone.

    By product family

    Unassigned5 CVEs
    Unassigned
    SeverityCVEDescriptionKB articleCVSS
    CriticalCVE-2026-3869

    CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC.

    		—9.2
    HighCVE-2026-77120

    CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.

    		—8.7
    HighCVE-2026-19233

    CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint.

    		—8.6
    HighCVE-2026-8044

    CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when malicious arguments are provided as backup configuration parameters.

    		—8.6
    MediumCVE-2026-81861

    CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.

    		—5.9