Quick answers
- Is CVE-2026-22620 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-22620 being exploited in the wild.
- How severe is CVE-2026-22620?
- High severity, with a CVSS score of 8.6, published 30 July 2026.
- Which products and versions are affected?
- Eaton PADM firmware <= 20.
- Is there a fix for CVE-2026-22620?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-22620 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-22620?
- Check whether you run Eaton PADM firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability exists in the Eaton Tripp Lite series PADM firmware version 20 and earlier. The flaw is rooted in improper input validation within the authentication component, specifically identified as an SQL injection (CWE-89) vulnerability. A remote, unauthenticated attacker can exploit this by sending specially crafted network requests to the device's management interface. Successful exploitation allows the attacker to bypass security controls and gain privileged access, potentially leading to full device compromise or denial of service. Users are advised that this product series has reached End of Life (EOL).
Affected products
- Eaton Tripp Lite series PADM firmware <= 20
Timeline
- 2026-07-30: advisory: Initial disclosure by Eaton and NVD publication