Loading story…
Schneider Electric disclosed multiple vulnerabilities in its industrial-control portfolio, affecting EcoStruxure IT Data Center Expert version 9.1.2 and earlier and PowerLogic T300 version 2.9.8-5620 and earlier. The PowerLogic T300 flaw stems from improper neutralization of special elements in an operating-system command, creating an OS command-injection risk.
The Canadian Centre for Cyber Security issued advisory AV26-912 and urged administrators to review Schneider Electric security notifications, implement vendor-recommended mitigations, and apply required updates. Organizations operating affected products should identify exposed deployments and prioritize remediation, particularly for systems connected to operational-technology or data-center environments.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-912 on the Schneider Electric vulnerabilities and advised users to review security notifications, implement mitigations, and apply necessary updates.
Schneider Electric reported vulnerabilities affecting EcoStruxure IT Data Center Expert and PowerLogic T300. PowerLogic T300 versions 2.9.8-5620 and earlier were affected by an OS command injection flaw caused by improper neutralization of special elements in an OS command.
Schneider Electric published advisory SEVD-2026-251-01 and patches for EcoStruxure IT Data Center Expert vulnerabilities tracked as CVE-2026-19233 and CVE-2026-8044. The vulnerabilities were listed as network-accessible and capable of high confidentiality, integrity, and availability impact for an authenticated attacker with high privileges.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcetenable.com
Open sourcese.com
Open sourcedownload.se.com
Open sourcedownload.se.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Schneider Electric published a set of security advisories covering multiple **EcoStruxure** and **Modicon** product lines, with impacts ranging from remote code execution to loss of confidentiality and integrity and security policy bypass. Affected products named across the notices include **EcoStruxure Foxboro DCS**, **EcoStruxure Automation Expert**, **EcoStruxure IT Data Center Expert**, **EcoStruxure Power Monitoring Expert**, **EcoStruxure Power Operation Advanced Reporting and Dashboards Module**, and several **Modicon PLC** families. National cyber agencies in Canada and France urged organizations to review Schneider Electric bulletins and apply vendor-provided mitigations and updates. One of the disclosed issues, tracked by CISA for **EcoStruxure Foxboro DCS**, is a **deserialization of untrusted data** flaw (`CWE-502`) affecting workstation and server components in versions prior to `CS8.1`; Schneider said Control Core Services and runtime components such as FCPs, FDCs, and FBMs are not affected. The vulnerability can enable loss of confidentiality and integrity and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation. The broader March advisory set references **`CVE-2025-11739`**, **`CVE-2025-13957`**, **`CVE-2026-1286`**, and **`CVE-2026-2273`**, and defenders are being told to prioritize patching alongside standard ICS protections such as network segmentation, firewalling, restricted access, and secured remote connectivity.
Jun 29, 2026
CISA and Schneider Electric disclosed a critical vulnerability in the EcoStruxure OPC UA Server Expert and Modicon Communication Server products, which are widely deployed in commercial facilities, critical manufacturing, and energy sectors. The flaw, tracked as CVE-2024-10085, is an 'allocation of resources without limits or throttling' issue that allows remote attackers to cause a denial of service by sending a large number of OPC UA requests, potentially resulting in the loss of real-time process data from Modicon Controllers. The vulnerability has a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.2, indicating a high level of risk, and was reported by Jin Huang of ADLab of Venustech. Schneider Electric has released a fix for the EcoStruxure OPC UA Server Expert in version SV2.01 SP3, which is available for download. For users unable to immediately apply the update, Schneider Electric recommends implementing specific mitigations to reduce the risk of exploitation. A permanent remediation plan is also being developed for all future versions of the Modicon Communication Server. CISA urges asset owners and operators in affected sectors to review the advisories and apply the recommended mitigations to protect against potential denial-of-service attacks targeting these critical industrial control systems.
Jun 29, 2026
Schneider Electric disclosed vulnerabilities affecting **NetBotz 5 750/755** devices running version **5.5.2 or earlier** and **PowerChute Serial Shutdown** version **1.5 or earlier**. The NetBotz devices are affected by multiple unspecified vulnerabilities, while PowerChute Serial Shutdown contains an improper restriction of excessive authentication attempts flaw that could permit repeated authentication attempts. The Canadian Centre for Cyber Security issued advisory **AV26-871**, directing organizations using the affected products to review Schneider Electric security notices **SEVD-2026-223-01** and **SEVD-2026-223-02**, apply the vendor’s recommended mitigations, and install available updates. Administrators should identify exposed or operationally critical deployments and prioritize remediation to reduce the risk of unauthorized access or disruption.
Sep 2, 2026