1. Executive summary
CISA ICS Advisory ICSA-26-190-02 discloses six vulnerabilities in Schneider Electric PowerChute Serial Shutdown (versions 1.4 and prior) running on Windows, Red Hat Enterprise Linux, and SuSE Linux. The flaws span path traversal (CWE-22), output encoding (CWE-116), resource consumption (CWE-400), input validation (CWE-1284), CRLF injection (CWE-93), and sensitive information in log files (CWE-532). Successful exploitation could allow attackers to overwrite critical system files, forge log data, gain unauthorized account access, trigger denial-of-service conditions, truncate audit logs, reset user credentials, or expose sensitive information. None of the CVEs are currently listed in the CISA KEV, and no known public exploitation has been reported. EMEA financial services running PowerChute in data centre or campus UPS management deployments should treat this as a medium-priority patching task, with urgency driven by the path-traversal and CRLF-injection vectors.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17: ICT-related incident management process | PowerChute vulnerabilities could overwrite critical files, truncate audit logs, and reset credentials, constituting ICT-related incidents requiring management. | Firms must ensure incident management processes can detect and respond to file overwrite, log truncation, and credential reset events on PowerChute hosts. |
| DORA Art. 18: classification of ICT-related incidents and cyber threats | Six distinct CVEs with MEDIUM/LOW severity form a cyber threat cluster requiring classification. | Incidents arising from these vulnerabilities must be classified per the firm's DORA taxonomy; the CVSS 6.9 MEDIUM path-traversal is the highest-severity trigger. |
| DORA Art. 24: digital operational resilience testing — general requirements | PowerChute is OT-adjacent infrastructure software (UPS management) whose compromise could affect operational resilience. | Firms should include PowerChute hosts in resilience testing scope and verify patched versions are deployed. |
| NIS2 Art. 21(2)(d): supply chain security measures | PowerChute is third-party software from Schneider Electric deployed in critical infrastructure sectors. | NIS2 in-scope entities must ensure vendor security advisories are tracked and patches applied as part of supply chain security measures. |
3. Technical analysis & attack chain
Affected products
- Schneider Electric PowerChute Serial Shutdown versions 1.4 and prior
- Platforms: Microsoft Windows, Red Hat Enterprise Linux, SuSE Linux
Vulnerability inventory
| CVE | CVSS (v4.0) | Severity | CWE | Description |
|---|---|---|---|---|
| CVE-2026-2399 | 6.9 | MEDIUM | CWE-22 | Path traversal — critical system files can be overwritten with unintended data. Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
| CVE-2026-2404 | 6.9 | MEDIUM | CWE-116 | Improper encoding/escaping of output — crafted input reflected in log files in unexpected ways. Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CVE-2026-2405 | 5.3 | MEDIUM | CWE-400 | Uncontrolled resource consumption — excessive triggering of certain system operations causes DoS. Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CVE-2026-2403 | 5.3 | MEDIUM | CWE-1284 | Improper validation of specified quantity in input — event and data logs can be truncated, losing audit information. Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CVE-2026-2400 | 5.3 | MEDIUM | CWE-93 | CRLF injection — improper handling of newline sequences enables unexpected modification of configuration-related data. Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CVE-2026-2401 | 2.4 | LOW | CWE-532 | Insertion of sensitive information into log file — sensitive data logged during certain user-triggered operations. Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Discrepancy note: The CISA advisory references CVE-2026-2402 (CWE-307, improper restriction of excessive authentication attempts) with a fix in version 1.5, but this CVE is absent from the verified reference data. The verified data covers CVE-2026-2399 through CVE-2026-2401 and CVE-2026-2403 through CVE-2026-2405. CVE-2026-2402 should be treated as real (it is in the vendor advisory) but its CVSS and KEV status could not be verified against authoritative data.
Attack chain (confirmed steps from advisory)
- Initial access — network-adjacent or remote. CVE-2026-2399 (path traversal) requires adjacent-network access with high privileges (PR:H). CVE-2026-2404 (output encoding) is remotely exploitable with no privileges (PR:N). CVE-2026-2400, CVE-2026-2403, and CVE-2026-2405 require low privileges over the network (PR:L). CVE-2026-2401 requires local access with user interaction.
- File overwrite via path traversal (CVE-2026-2399). An attacker with high privileges on an adjacent network can exploit improper file-path restriction to overwrite critical system files with unintended data. This is the highest-impact flaw: integrity and availability impact rated HIGH in the CVSS vector (VI:H/VA:H).
- Log forgery and audit-trail degradation (CVE-2026-2404, CVE-2026-2403). CVE-2026-2404 allows crafted input to be reflected into log files in unexpected ways, enabling log forgery or injection of malicious log data. CVE-2026-2403 allows quantity-related input validation flaws to truncate event and data logs, destroying audit information and reducing visibility into system behaviour.
- Configuration data modification via CRLF injection (CVE-2026-2400). Improper handling of newline sequences in certain inputs enables unexpected modification of configuration-related data. This could alter PowerChute behaviour or inject malicious configuration entries.
- Denial of service (CVE-2026-2405). Excessive triggering of certain system operations causes uncontrolled resource consumption, resulting in availability degradation.
- Credential reset and sensitive information exposure. The advisory states exploitation could allow "unauthorized account access" and "reset user credentials." CVE-2026-2401 separately causes sensitive information to be written to log files during certain user-triggered operations, creating an information-disclosure risk for anyone with log access.
What the source does NOT provide
- No specific exploit payloads, commands, file paths, or registry keys are documented.
- No malware, persistence mechanisms, C2 infrastructure, or lateral movement techniques are described.
- No threat actor attribution is mentioned — this is a vulnerability disclosure, not an incident report.
- No IOCs are provided.
- No proof-of-concept code is referenced.
Confidence caveat: All technical detail above is single-sourced (CISA ICSA-26-190-02 / Schneider Electric SEVD-2026-104-01). No independent corroboration of exploitability or active exploitation was available at time of writing. EPSS scores are 0% across all six CVEs, and none appear in the CISA KEV catalogue.
4. Mitigation & containment
P1 — Within 24 hours
- Inventory and assess. Identify all PowerChute Serial Shutdown deployments across the estate. Determine version (1.4 or prior = vulnerable; 1.5 = fixed). Check Windows, RHEL, and SuSE hosts. PowerChute is typically installed on servers connected to APC/Schneider UPS units via serial cable.
- Network isolation. Ensure PowerChute hosts are not accessible from the internet. Place them behind firewalls and isolate from business networks. If remote access is required, use VPN with current patches. CISA explicitly recommends minimising network exposure for all control system devices.
- Restrict access. Limit administrative access to PowerChute hosts to authorised OT/facilities management personnel only. The path-traversal CVE-2026-2399 requires high privileges (PR:H) — restricting privileged accounts reduces the primary attack surface.
P2 — Within 72 hours
- Apply vendor fix — upgrade to version 1.5. This is the definitive remediation for all six CVEs (and CVE-2026-2402). - Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ - Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ - Version 1.5 is confirmed fixed on Microsoft Windows, Red Hat Enterprise Linux, and SuSE Linux.
- Apply hardening guidance. Follow the Schneider Electric PowerChute Serial Shutdown Security Handbook: https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
- Log monitoring. Until patching is complete, monitor PowerChute log files for signs of forgery (CVE-2026-2404), truncation (CVE-2026-2403), or sensitive information leakage (CVE-2026-2401). Alert on unexpected log truncation or anomalous entries containing encoded/special characters.
P3 — Within 7 days
- Verify patch deployment. Confirm all PowerChute Serial Shutdown instances are running version 1.5. Decommission or isolate any hosts that cannot be upgraded immediately.
- Review UPS management architecture. Assess whether PowerChute hosts need network connectivity at all; serial-connected UPS management can often operate air-gapped or on a dedicated OT network segment.
- Update asset management and vendor advisory tracking. Subscribe to Schneider Electric CPCERT notifications. Add SEVD-2026-104-01 to the firm's vulnerability register with closure tracking.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules. The source material does not provide specific file paths, process names, command-line arguments, registry keys, network indicators, or distinctive strings that could be used to construct reliable YARA or Sigma rules. Detection should focus on behavioural monitoring of PowerChute hosts: anomalous file writes outside expected installation directories (path traversal), unexpected log truncation or malformed log entries (log forgery/CRLF injection), and resource exhaustion patterns (DoS).
CVE assessment
6 referenced CVEs
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-2399 | 6.9 Medium | — | 0% | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause cri… |
| CVE-2026-2404 | 6.9 Medium | — | 0% | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an atta… |
| CVE-2026-2405 | 5.3 Medium | — | 0% | CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and… |
| CVE-2026-2403 | 5.3 Medium | — | 0% | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation… |
| CVE-2026-2400 | 5.3 Medium | — | 0% | CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user cred… |
| CVE-2026-2401 | 2.4 Low | — | 0% | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be… |
7. Sources
- CISA, Schneider Electric PowerChute Serial Shutdown (ICSA-26-190-02), https://www.cisa.gov/news-events/ics-advisories/icsa-26-190-02, 2026-07-09
- Schneider Electric CPCERT, Multiple Vulnerabilities on PowerChute Serial Shutdown (SEVD-2026-104-01) PDF, https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf, 2026-04-14
- Schneider Electric CPCERT, Multiple Vulnerabilities on PowerChute Serial Shutdown (SEVD-2026-104-01) CSAF, https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2026-104-01.json, 2026-04-14
- Schneider Electric, PowerChute Serial Shutdown Security Handbook, https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN
- Schneider Electric, PowerChute Serial Shutdown v1.5 — Windows download, https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
- Schneider Electric, PowerChute Serial Shutdown v1.5 — Linux download, https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/
8. Adverse Trace position
Severity: MEDIUM. The highest-severity CVEs (CVE-2026-2399 and CVE-2026-2404, both CVSS 6.9 MEDIUM) present real but bounded risk: the path-traversal flaw requires high privileges and adjacent-network access, limiting opportunistic exploitation, while the output-encoding flaw has low integrity impact. No active exploitation has been reported, EPSS is 0% across all CVEs, and none are in the CISA KEV. For EMEA financial services, the primary risk is to data centre and facilities infrastructure where PowerChute manages UPS systems — compromise could degrade power management visibility or integrity during an incident, indirectly affecting operational resilience. Firms should upgrade to version 1.5 within the P2 window (72 hours) where feasible, prioritising hosts with network exposure. We will monitor for any proof-of-concept code or KEV additions and re-issue if the threat landscape changes. Attribution is not applicable — this is a vulnerability disclosure with no actor involvement indicated.
Published via PulseTrace — Adverse Trace threat intelligence.