# CVE-2026-41021: Eaton easyE4 weak password policy offline attack

Source: https://junglewise.ai/threats/cve-2026-41021-eaton-easye4-uses-an-insufficiently-strong-password-policy-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-41021 · Severity: high · CVSS 7.5 · Published 2026-10-27

Eaton easyE4 industrial control system uses insufficiently strong password policies, allowing attackers who obtain password hashes (for example through a separate vulnerability) to perform offline password-guessing attacks. A successful attack could compromise user credentials and lead to unauthorized access to critical industrial equipment.

Technologies: [Eaton easyE4](https://junglewise.ai/threats/technologies/easye4). Vendors: [Eaton](https://junglewise.ai/threats/vendors/eaton).

## Quick answers

**Is CVE-2026-41021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41021 being exploited in the wild.

**How severe is CVE-2026-41021?** High severity, with a CVSS score of 7.5, published 27 October 2026.

**Which products and versions are affected?** Eaton easyE4.

**Is there a fix for CVE-2026-41021?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41021 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-41021?** Check whether you run Eaton easyE4. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from weak password policy enforcement in easyE4, enabling offline dictionary or brute-force attacks against captured password hashes. An attacker must first obtain a password hash, potentially via CVE-2026-41020 or similar disclosure, then conduct computation-intensive cracking locally without network interaction. Successful exploitation results in plaintext credential recovery and system access.

## Affected products

- Eaton easyE4

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf](https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf)

## Related threats

- [Eaton easySoft improper TLS certificate validation](https://junglewise.ai/threats/cve-2026-41022-eaton-easysoft-improperly-validates-tls-certificates-presented-by)
- [Eaton easyE4 static nonce authentication bypass](https://junglewise.ai/threats/cve-2026-41020-eaton-easye4-uses-a-static-nonce-during-authentication-which)