Loading vulnerability…
Security Policy Bypass in Schneider Electric STW6 and STW6000 Web HMI Panels
CVE-2026-96434 affects Schneider Electric Harmony STW6 and Pro-face STW6000 HTML5 Web HMI panels, with all current firmware versions reported as affected. The vulnerability permits security policy bypass and is attributed to an obsolete, unmaintained embedded browser component. Processing malicious web content is reported to permit arbitrary code execution on the HMI. The precise vulnerable function, underlying memory-corruption mechanism, and claimed sandbox escape are not established. The reported CVSS v3.1 score is 8.8, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Security policy bypass is the explicitly identified impact. Reported arbitrary code execution could compromise HMI confidentiality, integrity, and availability. Potential operational consequences include falsified process displays, concealed operator alarms, unauthorized commands to reachable industrial controllers, and lateral movement within operational technology networks. Root-level access and safety-system compromise are not established.
If you can’t patch tonight, do this now.
Restrict browser navigation to approved local PLC or visualization servers and prevent unauthorized changes to the configured destination. Block unnecessary HMI internet access, restrict outbound connections to approved endpoints, and isolate panels within dedicated automation network segments without direct enterprise IT routing. Protect trusted visualization servers and network infrastructure against compromise or traffic redirection. Monitor unexpected HMI web and DNS connections and unauthorized industrial-protocol writes. Restrict physical access and lock or disable unused USB ports.
Patch, then assume compromise.
Consult Schneider Electric security notification SEVD-2026-286-01 for product-specific remediation and applicable firmware updates. Deploy vendor-approved updates addressing the embedded browser component when available. No fixed firmware version is identified, so update availability and coverage must be confirmed with the vendor.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.