Quick answers
- Is CVE-2026-22621 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-22621 being exploited in the wild.
- How severe is CVE-2026-22621?
- High severity, with a CVSS score of 8.3, published 30 July 2026.
- Which products and versions are affected?
- Eaton Tripp Lite Series PADM Firmware <= 20.
- Is there a fix for CVE-2026-22621?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-22621 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-22621?
- Check whether you run Eaton Tripp Lite Series PADM Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability (CWE-78) exists in the session management interface of Eaton Tripp Lite Series PADM firmware versions 20 and prior. The flaw stems from improper validation of input provided to the interface, which allows an authenticated user with administrator privileges to bypass restricted environments and execute arbitrary system commands. The attack vector is network-based and requires low complexity, though it does necessitate valid credentials. Successful exploitation grants the attacker high impact on confidentiality and integrity, and low impact on availability. Eaton has issued an End-of-Life (EOL) notice for the affected firmware version.
Affected products
- Eaton Tripp Lite Series PADM firmware <= 20
Timeline
- 2026-07-30: disclosed: Initial publication of the CVE record and Eaton advisory.