# CVE-2026-22621: Eaton Tripp Lite Series PADM command injection in session management interface

Source: https://junglewise.ai/threats/cve-2026-22621-eaton-tripp-lite-series-padm-command-injection-in-session  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-22621 · Severity: high · CVSS 8.3 · Published 2026-07-30

Eaton's Tripp Lite Series PADM firmware, which is used to manage power distribution units and uninterruptible power supplies, contains a security flaw in its session management interface. An authenticated administrator could exploit this weakness to run unauthorized commands on the device. This could lead to full control over the power management system, potentially resulting in unauthorized configuration changes or service disruptions.

Vendors: [Eaton](https://junglewise.ai/threats/vendors/eaton).

## Quick answers

**Is CVE-2026-22621 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22621 being exploited in the wild.

**How severe is CVE-2026-22621?** High severity, with a CVSS score of 8.3, published 30 July 2026.

**Which products and versions are affected?** Eaton Tripp Lite Series PADM Firmware <= 20.

**Is there a fix for CVE-2026-22621?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22621 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-22621?** Check whether you run Eaton Tripp Lite Series PADM Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in the session management interface of Eaton Tripp Lite Series PADM firmware versions 20 and prior. The flaw stems from improper validation of input provided to the interface, which allows an authenticated user with administrator privileges to bypass restricted environments and execute arbitrary system commands. The attack vector is network-based and requires low complexity, though it does necessitate valid credentials. Successful exploitation grants the attacker high impact on confidentiality and integrity, and low impact on availability. Eaton has issued an End-of-Life (EOL) notice for the affected firmware version.

## Affected products

- Eaton Tripp Lite Series PADM firmware <= 20

## Timeline

- 2026-07-30: disclosed: Initial publication of the CVE record and Eaton advisory.

## References

- [https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf](https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory.pdf)
- [https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/eol/secure/eaton-tripp-lite-series-padm-20-eol-notice.pdf](https://www.eaton.com/content/dam/eaton/products/backup-power-ups-surge-it-power-distribution/eol/secure/eaton-tripp-lite-series-padm-20-eol-notice.pdf)