CVE-2026-81861

CVE-2026-81861 is an insufficiently protected credentials flaw (CWE-522) affecting Schneider Electric SCADAPack x70 remote telemetry units (RTUs), in which authentication information is not adequately safeguarded. Because the flaw is network-reachable (AV:N) but requires some user interaction (UI:A) and for the vulnerable condition to be present (AT:P), an attacker would most plausibly induce an operator or legitimate user to take an action that exposes or transmits authentication data. A successful attack yields high confidentiality impact on the vulnerable system: exposure of authentication information that can then be reused to gain unauthorized access to RTU functionality, potentially allowing an adversary to read or manipulate remote telemetry and control operations. Organizations running SCADAPack x70 units in SCADA/ICS environments — typically utilities, oil and gas pipeline operators, and water/wastewater facilities — are the affected population. The issue carries a CVSS v4.0 base score of 5.9 (medium), is not in the CISA KEV catalog, and no public proof-of-concept or observed exploitation is known at this time.

What to do: Apply the Schneider Electric security notification and firmware/software updates for SCADAPack x70 as soon as the advisory specifies fixed builds, since exact patched versions are not listed in this data. Rotate all RTU and management-console credentials on the assumption they may have been exposed, and verify that x70 management/network interfaces are not reachable from untrusted networks (enforce OT segmentation, VPN, or allowlisting). Because user interaction is part of the attack chain, brief operators to treat unsolicited links, configuration files, or authentication prompts involving SCADAPack tooling with suspicion, and review authentication and access logs for anomalous RTU sessions.