Schneider Electric PowerChute Serial Shutdown
CISA and Schneider Electric warn that PowerChute Serial Shutdown 1.5 and prior lack brute-force protection, allowing unauthorized account access via unlimited authentication attempts.
CVE-2026-13348 (CWE-307, CVSS 5.3) in Schneider Electric PowerChute Serial Shutdown versions 1.5 and prior lets attackers perform an arbitrary number of authentication attempts when redirect handling is disabled, gaining unauthorized access to user accounts. The UPS management software is deployed across commercial facilities, critical manufacturing, energy, and IT sectors worldwide. CISA advisory ICSA-26-260-07 recommends network isolation, VPN-protected remote access, and applying the vendor fix.
- CVE-2026-13348: improper restriction of excessive authentication attempts (CWE-307)
- Exploitable when redirect handling is disabled; CVSS 3.1 score 5.3
- Affects PowerChute Serial Shutdown versions 1.5 and prior; fix available
- No evidence of exploitation reported
- CVEs
- CVE-2026-13348
- Vendors
- Schneider Electric
- Products
- PowerChute Serial Shutdown
- Organizations
- CISA
- Countries
- France
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-13348 | Password brute-force flaw in Schneider Electric PowerChute Serial Shutdown | 6.9 | <1% |
From the original article
5 min read at cisa.govView CSAF Summary Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.