# CVE-2026-2273: Schneider Electric EcoStruxure Automation Expert code injection

Source: https://junglewise.ai/threats/cve-2026-2273-schneider-electric-ecostruxure-automation-expert-code-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-2273 · Severity: high · CVSS 8.2 · Published 2026-03-10

A vulnerability in Schneider Electric's EcoStruxure Automation Expert could allow an attacker to take control of an engineering workstation. This occurs when a user is tricked into opening a specially crafted, malicious project file. Successful exploitation could lead to unauthorized access to sensitive industrial control data or disruption of automated systems managed by the workstation.

Vendors: [Schneider Electric](https://junglewise.ai/threats/vendors/schneider-electric).

## Quick answers

**Is CVE-2026-2273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2273 being exploited in the wild.

**How severe is CVE-2026-2273?** High severity, with a CVSS score of 8.2, published 10 March 2026.

**Which products and versions are affected?** Schneider Electric Ecostruxure Automation Expert Versions prior to v25.0.1.

**Is there a fix for CVE-2026-2273?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-2273 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-2273?** Check whether you run Schneider Electric Ecostruxure Automation Expert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in Schneider Electric EcoStruxure Automation Expert due to improper control of code generation. The flaw is triggered when an authenticated user opens a maliciously crafted project file, leading to the execution of arbitrary commands on the local engineering workstation. This local attack requires user interaction but can result in a full compromise of the workstation's integrity and availability, potentially impacting connected industrial systems. The vulnerability is addressed in version 25.0.1.

## Affected products

- Schneider Electric EcoStruxure Automation Expert Versions prior to v25.0.1

## Timeline

- 2026-03-10: disclosed
- 2026-03-10: advisory
- 2026-06-23: other: NVD analysis updated

## References

- [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-04.pdf)