Is CVE-2026-6866 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6866 being exploited in the wild.

How severe is CVE-2026-6866?

High severity, with a CVSS score of 7.5, published 12 May 2026.

Which products and versions are affected?

Schneider Electric Ecostruxure Panel Server Pas400 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas600 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas600v2 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas800 Versions prior to 002.006.000; and 1 more.

Is there a fix for CVE-2026-6866?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6866 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-6866?

Check whether you run Schneider Electric Ecostruxure Panel Server Pas400, Schneider Electric Ecostruxure Panel Server Pas400 Firmware, Schneider Electric Ecostruxure Panel Server Pas600 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6866: Schneider Electric EcoStruxure Panel Server insecure default credentials

CVE-2026-6866 · Severity: high · CVSS 7.5 · Published 2026-05-12

Schneider Electric EcoStruxure Panel Servers, which are used to manage and monitor electrical distribution systems, contain a vulnerability that can cause security credentials to revert to their factory default settings. This could allow an unauthorized person to log into the device using well-known default passwords. Successful exploitation could lead to the exposure of sensitive operational data and unauthorized access to the management interface.

Vendors: Schneider Electric.

Quick answers

Is CVE-2026-6866 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6866 being exploited in the wild.
How severe is CVE-2026-6866?: High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?: Schneider Electric Ecostruxure Panel Server Pas400 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas600 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas600v2 Versions prior to 002.006.000; Schneider Electric Ecostruxure Panel Server Pas800 Versions prior to 002.006.000; and 1 more.
Is there a fix for CVE-2026-6866?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6866 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-6866?: Check whether you run Schneider Electric Ecostruxure Panel Server Pas400, Schneider Electric Ecostruxure Panel Server Pas400 Firmware, Schneider Electric Ecostruxure Panel Server Pas600 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CWE-1188 (Initialization of a Resource with an Insecure Default) vulnerability exists in Schneider Electric EcoStruxure Panel Server firmware. Under specific rare circumstances, the device may revert its authentication credentials to initial factory settings. An unauthenticated attacker with network access to the device can exploit this by using known default credentials to gain unauthorized access. This can lead to the disclosure of sensitive information stored on or managed by the panel server. The issue is addressed in firmware version 002.006.000 and later.

Affected products

Schneider Electric EcoStruxure Panel Server PAS400 Versions prior to 002.006.000
Schneider Electric EcoStruxure Panel Server PAS600 Versions prior to 002.006.000
Schneider Electric EcoStruxure Panel Server PAS600V2 Versions prior to 002.006.000
Schneider Electric EcoStruxure Panel Server PAS800 Versions prior to 002.006.000
Schneider Electric EcoStruxure Panel Server PAS800V2 Versions prior to 002.006.000

Timeline

2026-05-12: disclosed
2026-05-12: advisory

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.