Loading story…
Schneider Electric disclosed vulnerabilities affecting NetBotz 5 750/755 devices running version 5.5.2 or earlier and PowerChute Serial Shutdown version 1.5 or earlier. The NetBotz devices are affected by multiple unspecified vulnerabilities, while PowerChute Serial Shutdown contains an improper restriction of excessive authentication attempts flaw that could permit repeated authentication attempts.
The Canadian Centre for Cyber Security issued advisory AV26-871, directing organizations using the affected products to review Schneider Electric security notices SEVD-2026-223-01 and SEVD-2026-223-02, apply the vendor’s recommended mitigations, and install available updates. Administrators should identify exposed or operationally critical deployments and prioritize remediation to reduce the risk of unauthorized access or disruption.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued advisory AV26-871 covering the Schneider Electric NetBotz and PowerChute Serial Shutdown vulnerabilities and advised users to review vendor notifications, implement mitigations, and apply necessary updates.
Schneider Electric reported multiple vulnerabilities affecting NetBotz 5 750/755 devices running version 5.5.2 or earlier, and an improper restriction of excessive authentication attempts vulnerability affecting PowerChute Serial Shutdown version 1.5 or earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcedownload.se.com
Open sourcedownload.se.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Schneider Electric disclosed a **high-severity vulnerability** affecting **NetBotz 5 750** and **NetBotz 5 755** appliances running version **5.5.2 and earlier**. According to national CERT and CSIRT notices, successful exploitation could allow a malicious user to execute arbitrary code on impacted systems, creating a significant risk for organizations that use the devices for environmental monitoring and physical security in operational environments. Government advisories from Paraguay's CERT and Italy's ACN/CSIRT Italia directed defenders to Schneider Electric's security bulletin for remediation and mitigation guidance. Organizations using affected NetBotz products have been urged to identify exposed or deployed units, review Schneider Electric's recommended mitigations, and apply vendor-provided fixes to reduce the risk of compromise.
Aug 11, 2026
Schneider Electric published a set of security advisories covering multiple **EcoStruxure** and **Modicon** product lines, with impacts ranging from remote code execution to loss of confidentiality and integrity and security policy bypass. Affected products named across the notices include **EcoStruxure Foxboro DCS**, **EcoStruxure Automation Expert**, **EcoStruxure IT Data Center Expert**, **EcoStruxure Power Monitoring Expert**, **EcoStruxure Power Operation Advanced Reporting and Dashboards Module**, and several **Modicon PLC** families. National cyber agencies in Canada and France urged organizations to review Schneider Electric bulletins and apply vendor-provided mitigations and updates. One of the disclosed issues, tracked by CISA for **EcoStruxure Foxboro DCS**, is a **deserialization of untrusted data** flaw (`CWE-502`) affecting workstation and server components in versions prior to `CS8.1`; Schneider said Control Core Services and runtime components such as FCPs, FDCs, and FBMs are not affected. The vulnerability can enable loss of confidentiality and integrity and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation. The broader March advisory set references **`CVE-2025-11739`**, **`CVE-2025-13957`**, **`CVE-2026-1286`**, and **`CVE-2026-2273`**, and defenders are being told to prioritize patching alongside standard ICS protections such as network segmentation, firewalling, restricted access, and secured remote connectivity.
Jun 29, 2026
Schneider Electric disclosed multiple vulnerabilities in its industrial-control portfolio, affecting **EcoStruxure IT Data Center Expert** version 9.1.2 and earlier and **PowerLogic T300** version 2.9.8-5620 and earlier. The PowerLogic T300 flaw stems from improper neutralization of special elements in an operating-system command, creating an OS command-injection risk. The Canadian Centre for Cyber Security issued advisory **AV26-912** and urged administrators to review Schneider Electric security notifications, implement vendor-recommended mitigations, and apply required updates. Organizations operating affected products should identify exposed deployments and prioritize remediation, particularly for systems connected to operational-technology or data-center environments.
Sep 11, 2026