CVE-2026-81861: Schneider Electric SCADAPack x70 insufficiently protected credentials

CVE-2026-81861 · Severity: high · CVSS 6.5 · Published 2026-09-11

Schneider Electric SCADAPack Remote Terminal Units (RTUs) are industrial devices used in critical infrastructure sectors like manufacturing and energy to enable remote monitoring and control of critical systems. A weakness in the Secure Lock security feature fails to adequately protect credentials, potentially allowing attackers to bypass authentication and gain unauthorized access to RTU configuration. This could lead to exposure of sensitive authentication data and unauthorized control over industrial systems, impacting operational safety and confidentiality.

Vendors: Schneider Electric.

Quick answers

Is CVE-2026-81861 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-81861 being exploited in the wild.
How severe is CVE-2026-81861?
High severity, with a CVSS score of 6.5, published 11 September 2026.
Which products and versions are affected?
Schneider Electric SCADAPack 32 all versions; Schneider Electric SCADAPack 3xx all versions; Schneider Electric SCADAPack 470R all versions; Schneider Electric SCADAPack 47x all versions; and 3 more.
Is there a fix for CVE-2026-81861?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-81861 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-81861?
Check whether you run Schneider Electric SCADAPack 32, Schneider Electric SCADAPack 3xx, Schneider Electric SCADAPack 470R or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as CWE-522 (Insufficiently Protected Credentials), affecting the legacy Secure Lock functionality in Schneider Electric SCADAPack x70 products. The vulnerability allows exposure of authentication information and unauthorized access to RTU functionality through inadequate credential protection mechanisms. The attack vector is network-based with no authentication required but does require user interaction (PR:N, UI:R), as indicated by the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The impact is limited to confidentiality (high) with no integrity or availability impact. Schneider Electric recommends implementing Role-Based Access Control (RBAC) as a replacement for the legacy Secure Lock feature, and applying network segmentation and RTU firewall controls to restrict access and reduce attack surface. No patch is available; mitigation relies on configuration changes and architectural controls.

Affected products

  • Schneider Electric SCADAPack 47x all versions
  • Schneider Electric SCADAPack 47xi all versions
  • Schneider Electric SCADAPack 47xd all versions
  • Schneider Electric SCADAPack 470R all versions
  • Schneider Electric SCADAPack 57x all versions
  • Schneider Electric SCADAPack 3xx all versions
  • Schneider Electric SCADAPack 32 all versions

Timeline

  • 2026-09-15: disclosed: CISA ICS Advisory ICSA-26-258-04 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.