Schneider Electric Harmony STW6 Vulnerability Enables Security Policy Bypass

CERT-FR has warned that CVE-2026-96434 affects all versions of Schneider Electric Harmony STW6 and can allow an attacker to bypass security policy. Its advisory, CERTFR-2026-AVI-1299, cites Schneider Electric security notification SEVD-2026-286-01. A separate technical report also identifies Pro-face STW6000 Web HMI panels as affected and attributes the flaw to an obsolete, unmaintained embedded browser component, assigning a CVSS v3.1 score of 8.8. That report claims malicious web content could enable arbitrary code execution through an attacker-controlled endpoint, a compromised PLC web server, or network interception; those technical details and the additional product scope are not independently confirmed by the supplied CERT-FR advisory.

Successful exploitation could, according to the technical report, allow falsified process displays, suppressed alarms, unauthorized industrial control commands, or lateral movement through operational technology networks. The supplied references provide no evidence of exploitation in the wild and identify no specific fixed firmware version. Operators should consult Schneider Electric’s bulletin for applicable remediation, while restricting HMI browser destinations, segmenting control networks, limiting outbound connections, and monitoring for unauthorized HMI communications and unexpected Modbus writes.