Loading story…
Schneider Electric published a set of security advisories covering multiple EcoStruxure and Modicon product lines, with impacts ranging from remote code execution to loss of confidentiality and integrity and security policy bypass. Affected products named across the notices include EcoStruxure Foxboro DCS, EcoStruxure Automation Expert, EcoStruxure IT Data Center Expert, EcoStruxure Power Monitoring Expert, EcoStruxure Power Operation Advanced Reporting and Dashboards Module, and several Modicon PLC families. National cyber agencies in Canada and France urged organizations to review Schneider Electric bulletins and apply vendor-provided mitigations and updates.
One of the disclosed issues, tracked by CISA for EcoStruxure Foxboro DCS, is a deserialization of untrusted data flaw (CWE-502) affecting workstation and server components in versions prior to CS8.1; Schneider said Control Core Services and runtime components such as FCPs, FDCs, and FBMs are not affected. The vulnerability can enable loss of confidentiality and integrity and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation. The broader March advisory set references CVE-2025-11739, CVE-2025-13957, CVE-2026-1286, and CVE-2026-2273, and defenders are being told to prioritize patching alongside standard ICS protections such as network segmentation, firewalling, restricted access, and secured remote connectivity.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
CERT-FR published a notice about a vulnerability in Schneider Electric EcoStruxure IT Data Center Expert products. The notice said the issue could allow compromise of data confidentiality, but provided no CVE, affected versions, exploitation status, or remediation details.
CISA published ICS advisory ICSA-26-083-02 covering Schneider Electric's disclosure of a deserialization vulnerability in EcoStruxure Foxboro DCS affecting versions prior to CS8.1. The advisory stated the flaw could enable loss of confidentiality, integrity, and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation.
CERT-FR published an advisory documenting multiple vulnerabilities in Schneider Electric products and referencing CVE-2025-11739, CVE-2025-13957, CVE-2026-1286, and CVE-2026-2273. The advisory highlighted risks including remote code execution, confidentiality and integrity compromise, and security policy bypass.
On March 10, 2026, Schneider Electric published multiple security bulletins covering vulnerabilities across EcoStruxure and Modicon product lines, including Foxboro DCS, Automation Expert, IT Data Center Expert, Power Monitoring Expert, Power Operation modules, and several Modicon PLC families. The bulletins advised customers to review vendor notifications and apply patches or mitigations.
CERT-FR noted a "new notification campaign" related to multiple Schneider Electric product vulnerabilities. The notice explicitly anchors this campaign as of February 26, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cert.ssi.gouv.fr
Open sourcecisa.gov
Open sourcecyber.gc.ca
Open sourcecert.ssi.gouv.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA and Schneider Electric disclosed a critical vulnerability in the EcoStruxure OPC UA Server Expert and Modicon Communication Server products, which are widely deployed in commercial facilities, critical manufacturing, and energy sectors. The flaw, tracked as CVE-2024-10085, is an 'allocation of resources without limits or throttling' issue that allows remote attackers to cause a denial of service by sending a large number of OPC UA requests, potentially resulting in the loss of real-time process data from Modicon Controllers. The vulnerability has a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.2, indicating a high level of risk, and was reported by Jin Huang of ADLab of Venustech. Schneider Electric has released a fix for the EcoStruxure OPC UA Server Expert in version SV2.01 SP3, which is available for download. For users unable to immediately apply the update, Schneider Electric recommends implementing specific mitigations to reduce the risk of exploitation. A permanent remediation plan is also being developed for all future versions of the Modicon Communication Server. CISA urges asset owners and operators in affected sectors to review the advisories and apply the recommended mitigations to protect against potential denial-of-service attacks targeting these critical industrial control systems.
Jun 29, 2026
Schneider Electric, Siemens, Aveva, and Rockwell Automation released security advisories and patches for industrial control system and operational technology products. Schneider Electric fixed **CVE-2026-3869**, a CVSS 9.2 authentication vulnerability affecting Modicon M580 and M580 Safety controllers that could permit unauthorized access and complete compromise of affected systems. Siemens issued nine advisories, four covering critical vulnerabilities, and began deploying fixes for the Linux kernel Copy Fail flaw, **CVE-2026-31431**, which can provide root-shell access. Aveva remediated sensitive-data exposure and password-security issues in Pipeline Integrity Monitor, while Rockwell Automation published nine advisories affecting RSLinx Classic, industrial controllers, and FactoryTalk products; organizations should prioritize applying vendor patches to exposed OT assets.
Sep 11, 2026
Schneider Electric disclosed multiple vulnerabilities in its industrial-control portfolio, affecting **EcoStruxure IT Data Center Expert** version 9.1.2 and earlier and **PowerLogic T300** version 2.9.8-5620 and earlier. The PowerLogic T300 flaw stems from improper neutralization of special elements in an operating-system command, creating an OS command-injection risk. The Canadian Centre for Cyber Security issued advisory **AV26-912** and urged administrators to review Schneider Electric security notifications, implement vendor-recommended mitigations, and apply required updates. Organizations operating affected products should identify exposed deployments and prioritize remediation, particularly for systems connected to operational-technology or data-center environments.
Sep 11, 2026