# CVE-2026-9716: Schneider Electric PowerLogic P7 NULL pointer dereference DoS

Source: https://junglewise.ai/threats/cve-2026-9716-schneider-electric-powerlogic-p7-null-pointer-dereference-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-9716 · Severity: info · CVSS 8.7 · Published 2026-06-25

A vulnerability in Schneider Electric PowerLogic P7 protection relays could allow an attacker to disable the device's management interface. These devices are critical components used in electrical power systems for monitoring and protection. If exploited, operators would lose the ability to configure the device or view status information through the Human Machine Interface (HMI), potentially impacting the reliability of power grid operations.

Technologies: [Schneider Electric PowerLogic P7](https://junglewise.ai/threats/technologies/powerlogic-p7). Vendors: [Schneider Electric](https://junglewise.ai/threats/vendors/schneider-electric).

## Quick answers

**Is CVE-2026-9716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9716 being exploited in the wild.

**How severe is CVE-2026-9716?** Informational severity, with a CVSS score of 8.7, published 25 June 2026.

**Which products and versions are affected?** Schneider Electric PowerLogic P7 Version V02.003.001.000 and prior.

**Is there a fix for CVE-2026-9716?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9716 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9716?** Check whether you run Schneider Electric PowerLogic P7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CWE-476 NULL Pointer Dereference vulnerability exists in Schneider Electric PowerLogic P7 devices (Version V02.003.001.000 and prior). The flaw is triggered when the device receives malformed requests over exposed network interfaces. An unauthenticated remote attacker can exploit this to cause a denial-of-service (DoS) condition, specifically rendering the Human Machine Interface (HMI) and configuration functionality unavailable. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting high availability impact. Remediation details are typically found in Schneider Electric's security notice SEVD-2026-160-03.

## Affected products

- Schneider Electric PowerLogic™ P7 Version V02.003.001.000 and prior

## Timeline

- 2026-06-25: disclosed: Initial disclosure by Schneider Electric and NVD publication.

## References

- [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-03.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-03.pdf)

## Related threats

- [Schneider Electric PowerLogic P7 reachable assertion in network service](https://junglewise.ai/threats/cve-2026-9718-schneider-electric-powerlogic-p7-reachable-assertion-in-network)
- [Schneider Electric PowerLogic P7 OS command injection](https://junglewise.ai/threats/cve-2026-9717-schneider-electric-powerlogic-p7-os-command-injection)