1. Executive summary
Schneider Electric has released version 1.6 of PowerChute Serial Shutdown to fix CVE-2026-13348, an improper restriction of excessive authentication attempts (CWE-307) rated CVSS 3.1 5.3 MEDIUM with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The flaw allows an unauthenticated network attacker to brute-force a user account without rate limiting when redirect handling is disabled, yielding read access to system data held by the PowerChute web console. All PowerChute Serial Shutdown versions up to and including 1.5 are affected, on both Windows and Linux. No CISA KEV listing or observed exploitation is recorded for this CVE. Financial services exposure is indirect: PowerChute runs on the desktops, servers and workstations that the UPS protects, so a compromised console account is a foothold on a managed host, not on the UPS itself.
2. Regulatory framing
| Article | Trigger | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | PowerChute Serial Shutdown is UPS management software installed on production servers and workstations; the flaw is in its authentication path and is testable by authenticated and unauthenticated network testing against the console | Include PowerChute console authentication in the ICT resilience testing scope; a brute-force test against the console is a concrete, repeatable test case for the next test cycle |
No specific NIS2 or UK NIS article is engaged by this item. The vulnerability is a vendor patch case with no incident, no third-party provider relationship beyond a normal software supplier, and no reportable event.
3. Technical analysis & attack chain
CVE-2026-13348 is a CWE-307 flaw in the authentication logic of the PowerChute Serial Shutdown management console. The vendor states that an attacker can perform an arbitrary number of authentication attempts when redirect handling is disabled. In other words, the account lockout or attempt-limiting control that normally applies to the console login is bypassable in a specific configuration state, so password guessing runs unthrottled. The CVSS vector confirms the exposure profile: network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to confidentiality (C:L) with no integrity or availability impact. The successful outcome is unauthorised access to a user account in the PowerChute console.
Confirmed attack chain:
- The attacker reaches the PowerChute Serial Shutdown console over the network on a host running version 1.5 or earlier. The console is the same interface used to configure graceful shutdown and energy management for the protected machine.
- Redirect handling on the target is disabled. The vendor does not state how this state arises, whether it is a default, a configuration option, or a side effect of a particular deployment; that detail is not in the advisory.
- The attacker submits repeated authentication attempts against a user account. Because excessive attempts are not restricted in this state, there is no effective lockout or throttling to stop an arbitrary number of guesses.
- A guessed or cracked credential grants access to the user account. The vendor assesses the impact as access to system data and potential disruption of operations.
What the advisory does not give: the specific port or URL path of the console, the HTTP mechanics of the redirect-handling condition, whether the flaw is in the web UI or a separate service, or any proof-of-concept detail. The affected version string in the CISA CSAF data is "PowerChute Serial Shutdown vers:intdot/<=1.5, 1.6 (CVE-2026-13348)", which reads as version 1.5 and prior affected and 1.6 fixed; the advisory text confirms 1.6 contains the fix. This advisory is a CISA republication of Schneider Electric SEVD-2026-223-01, originally released 2026-08-11, so the underlying facts are vendor-reported and single-sourced to Schneider Electric CPCERT, which also reported the vulnerability to CISA. No independent technical analysis of the flaw is available in the source material.
Context from the earlier PowerChute advisory ICSA-26-190-02 (SEVD-2026-104-01): a prior CWE-307 flaw in the same product was fixed in version 1.5 alongside path traversal, CRLF injection, log injection and resource consumption issues (CVE-2026-2399, CVE-2026-2400, CVE-2026-2401, CVE-2026-2403, CVE-2026-2404, CVE-2026-2405). The recurrence of the excessive-authentication-attempts class in consecutive versions suggests the authentication hardening in 1.5 was incomplete and is worth a targeted regression test after upgrading to 1.6.
4. Mitigation & containment
P1 (within 24 hours)
- Inventory for PowerChute Serial Shutdown on Windows and Linux hosts. The product ships with Schneider UPS deployments on servers, desktops and workstations. Record the version via the Control Panel entry or the About page in the PowerChute console after login.
- Restrict network access to the PowerChute console. Permit connections only from the administration workstations and monitoring hosts that need it, and block all other sources at the host firewall or the segment firewall. An unauthenticated network path to the console is the precondition for this attack.
- Check whether redirect handling is disabled on any installation. The vendor ties the vulnerability to that state. If the configuration cannot be verified quickly, treat the console as exposed and keep the network restriction in place.
P2 (within 72 hours)
- Upgrade to PowerChute Serial Shutdown v1.6, which contains the fix. Downloads: Windows at https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ and Linux at https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/. The service restarts automatically on installation; no separate reboot step is listed. Validate the install by checking the version in the Control Panel or on the About page in the console.
- Apply the hardening guidance in the Schneider Electric Security Handbook for PowerChute Serial Shutdown, referenced by the vendor for these remediations.
- Rotate credentials on PowerChute console accounts, particularly any that were in place while an affected version was network-reachable. The flaw permits password guessing against those accounts.
P3 (within 7 days)
- Review authentication logs from affected hosts for the period before the upgrade and look for repeated failed logins against the console. The advisory gives no logging specifics, so this review is best-effort against whatever the host records.
- Confirm no PowerChute console is reachable from the internet or from general user subnets, per the vendor's recommendation to minimise network exposure of control system devices.
- Add PowerChute console authentication to the resilience testing scope under DORA Art. 24, including a lockout test that verifies excessive attempts are rejected on v1.6.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source describes one observable behaviour: repeated failed authentication attempts against the PowerChute Serial Shutdown console, in the specific case where redirect handling is disabled. No port, path or log format is given, so the table below is limited to what the advisory supports.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Arbitrary number of authentication attempts against a PowerChute console user account, unthrottled, when redirect handling is disabled | Authentication logs on hosts running PowerChute Serial Shutdown 1.5 or earlier; network monitoring of traffic to the console | Medium, vendor-described behaviour, no field detail |
6. Detection
Insufficient indicators to author detection rules.
The advisory names no file paths, registry keys, mutexes, service names, command-line flags, console URLs or ports, and no log signatures. The only artefact is the product name and version, which is an inventory fact rather than a threat artefact, so no YARA or Sigma rule can be built from this source without inventing strings.
7. Sources
- CISA, ICS Advisory ICSA-26-260-07, Schneider Electric PowerChute Serial Shutdown (republished from SEVD-2026-223-01), https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-07, original release 2026-08-11, CISA republication 2026-09-17
- CISA, ICS Advisory ICSA-26-190-02, Schneider Electric PowerChute Serial Shutdown (SEVD-2026-104-01, prior multiple-vulnerability advisory), https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02
- Schneider Electric, PowerChute Serial Shutdown download, Windows, https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
- Schneider Electric, PowerChute Serial Shutdown download, Linux, https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
8. Adverse Trace position
We assess CVE-2026-13348 as a medium-severity flaw with a narrow but real exposure: an unauthenticated network attacker can brute-force a PowerChute console account when redirect handling is disabled, and the CVSS 3.1 5.3 MEDIUM rating with confidentiality-only impact matches that outcome. It is not KEV-listed and we have seen no evidence of exploitation, so the priority is patch discipline rather than incident response; the practical risk to EMEA financial services clients is concentrated in data centre and branch hosts where PowerChute manages UPS shutdown, and a compromised console account is a foothold on a managed server. Two gaps limit our confidence: the vendor has not explained how redirect handling comes to be disabled, and all technical detail is single-sourced to Schneider Electric CPCERT with no independent analysis, so clients should verify the lockout behaviour on v1.6 in their own environment rather than trust the fix implicitly. We will track SEVD-2026-223-01 for revisions, watch for a KEV listing or exploitation reporting, and update this advisory if the redirect-handling condition or any exploit detail becomes public.
Published via PulseTrace — Adverse Trace threat intelligence.