Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)
CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.
CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.
- CVE-2026-4827 (CVSS 8.3) is insufficient entropy in session management enabling session hijacking
- Affects Easergy, EcoStruxure Power, PowerLogic, and Saitel families used in substations
- Update A lists dozens of fixed firmware versions; no exploitation reported
- Risk spans energy, chemical, critical manufacturing, and water infrastructure sectors
- CVEs
- CVE-2026-4827
- Vendors
- Schneider Electric
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-4827 | CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in… | 8.7 | <1% |
From the original article
8 min read at cisa.govView CSAF Summary Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, protection and merging unit for large and critical infrastructure electrical distribution systems. The Easergy MiCOM P30 is a family of multifunction protection and control relays designed for medium, high and extra high voltage electrical networks.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.