# Schneider Electric vulnerabilities Source: https://junglewise.ai/threats/vendors/schneider-electric Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/schneider-electric.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in Schneider Electric: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-119055, was published on 11 November 2026. 1 vulnerability in the last four weeks, level on the four before (1). 2 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 9 - All time: 37 (1 critical, 1 exploited in the wild) ## About Schneider Electric Schneider Electric is a multinational company providing energy management and industrial automation products. ## Latest Schneider Electric vulnerabilities - [CVE-2026-119055: Schneider Electric EcoStruxure use-after-free in SSD file parsing](https://junglewise.ai/threats/cve-2026-119055-cwe-416-use-after-free-vulnerability-exists-that-could-cause) (info, published 11 Nov 2026) - [CVE-2026-102250: Schneider Electric firmware upload authentication bypass](https://junglewise.ai/threats/cve-2026-102250-cwe-345-insufficient-verification-of-data-authenticity) (info, published 13 Oct 2026) - [CVE-2025-6625: Schneider Electric Modicon M340 improper input validation in FTP service](https://junglewise.ai/threats/cve-2025-6625-schneider-electric-modicon-m340-improper-input-validation-in-ftp) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-81861: Schneider Electric SCADAPack x70 insufficiently protected credentials](https://junglewise.ai/threats/cve-2026-81861-schneider-electric-scadapack-x70-insufficiently-protected) (high, CVSS 6.5, published 11 Sep 2026) - [CVE-2026-3869: Schneider Electric PLC authentication algorithm incorrect implementation](https://junglewise.ai/threats/cve-2026-3869-schneider-electric-plc-authentication-algorithm-incorrect) (info, published 11 Sep 2026) - [CVE-2026-13348: Schneider Electric PowerChute Serial Shutdown improper authentication restriction](https://junglewise.ai/threats/cve-2026-13348-schneider-electric-powerchute-serial-shutdown-improper) (high, CVSS 5.3, published 1 Sep 2026) - [CVE-2026-13337: Schneider Electric NetBotz SQL injection in Hibernate query interface](https://junglewise.ai/threats/cve-2026-13337-schneider-electric-netbotz-sql-injection-in-hibernate-query) (info, published 1 Sep 2026) - [CVE-2026-13336: Schneider Electric NetBotz 5 750/755 OS command injection and SQL injection](https://junglewise.ai/threats/cve-2026-13336-schneider-electric-netbotz-5-750-755-os-command-injection-and-sql) (high, CVSS 6.4, published 1 Sep 2026) - [CVE-2024-10085: Schneider Electric OPC UA resource exhaustion denial of service](https://junglewise.ai/threats/cve-2024-10085-schneider-electric-opc-ua-resource-exhaustion-denial-of-service) (info, published 1 Sep 2026) - [CVE-2026-14354: Schneider Electric EcoStruxure Cybersecurity Admin Expert credential protection bypass](https://junglewise.ai/threats/cve-2026-14354-schneider-electric-ecostruxure-cybersecurity-admin-expert) (info, CVSS 8.7, published 29 Jul 2026) - [CVE-2026-12927: Schneider Electric IGSS Definition out-of-bounds write via CGF import](https://junglewise.ai/threats/cve-2026-12927-schneider-electric-igss-definition-out-of-bounds-write-via-cgf) (info, CVSS 8.4, published 29 Jul 2026) - [CVE-2026-0667: Schneider Electric SCADAPack code execution in Modbus TCP protocol handling](https://junglewise.ai/threats/cve-2026-0667-schneider-electric-scadapack-code-execution-in-modbus-tcp-protocol) (info, CVSS 9.3, published 29 Jul 2026) - [CVE-2026-9718: Schneider Electric PowerLogic P7 reachable assertion in network service](https://junglewise.ai/threats/cve-2026-9718-schneider-electric-powerlogic-p7-reachable-assertion-in-network) (info, CVSS 6.9, published 25 Jun 2026) - [CVE-2026-9717: Schneider Electric PowerLogic P7 OS command injection](https://junglewise.ai/threats/cve-2026-9717-schneider-electric-powerlogic-p7-os-command-injection) (info, CVSS 8.6, published 25 Jun 2026) - [CVE-2026-9716: Schneider Electric PowerLogic P7 NULL pointer dereference DoS](https://junglewise.ai/threats/cve-2026-9716-schneider-electric-powerlogic-p7-null-pointer-dereference-dos) (info, CVSS 8.7, published 25 Jun 2026) - [CVE-2026-9651: Schneider Electric RTU incorrect permission assignment in system files](https://junglewise.ai/threats/cve-2026-9651-schneider-electric-rtu-incorrect-permission-assignment-in-system) (info, CVSS 6.7, published 25 Jun 2026) - [CVE-2026-9650: Schneider Electric EasyLogic and Saitel RTU unprotected credentials](https://junglewise.ai/threats/cve-2026-9650-schneider-electric-easylogic-and-saitel-rtu-unprotected) (info, CVSS 8.7, published 25 Jun 2026) - [CVE-2026-8045: Schneider Electric Data Center Expert XXE in SOAP service](https://junglewise.ai/threats/cve-2026-8045-schneider-electric-data-center-expert-xxe-in-soap-service) (info, CVSS 7.1, published 9 Jun 2026) - [CVE-2026-6332: Schneider Electric EcoStruxure Machine Expert HVAC cleartext storage](https://junglewise.ai/threats/cve-2026-6332-schneider-electric-ecostruxure-machine-expert-hvac-cleartext) (high, CVSS 7.5, published 14 May 2026) - [CVE-2026-6866: Schneider Electric EcoStruxure Panel Server insecure default credentials](https://junglewise.ai/threats/cve-2026-6866-schneider-electric-ecostruxure-panel-server-insecure-default) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-6865: Schneider Electric path traversal in server-side file processing](https://junglewise.ai/threats/cve-2026-6865-schneider-electric-path-traversal-in-server-side-file-processing) (info, CVSS 7.1, published 12 May 2026) - [CVE-2026-4827: Schneider Electric products insufficient entropy in session management](https://junglewise.ai/threats/cve-2026-4827-schneider-electric-products-insufficient-entropy-in-session) (info, CVSS 8.7, published 12 May 2026) - [CVE-2026-2405: CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file…](https://junglewise.ai/threats/cve-2026-2405-cwe-400-uncontrolled-resource-consumption-vulnerability-exists) (medium, CVSS 6.5, published 14 Apr 2026) - [CVE-2026-2404: CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log…](https://junglewise.ai/threats/cve-2026-2404-cwe-116-improper-encoding-or-escaping-of-output-vulnerability) (medium, CVSS 5.3, published 14 Apr 2026) - [CVE-2026-2403: CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log…](https://junglewise.ai/threats/cve-2026-2403-cwe-1284-improper-validation-of-specified-quantity-in-input) (medium, CVSS 4.3, published 14 Apr 2026) ## Most severe Schneider Electric vulnerabilities - [CVE-2018-7841: Schneider Electric U.motion Builder SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2018-7841-schneider-electric-u-motion-builder-sql-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 15 Apr 2022) - [CVE-2026-2273: Schneider Electric EcoStruxure Automation Expert code injection](https://junglewise.ai/threats/cve-2026-2273-schneider-electric-ecostruxure-automation-expert-code-injection) (high, CVSS 8.2, published 10 Mar 2026) - [CVE-2025-13845: Schneider Electric Rapsody use-after-free in project file parsing](https://junglewise.ai/threats/cve-2025-13845-schneider-electric-rapsody-use-after-free-in-project-file-parsing) (high, CVSS 7.8, published 15 Jan 2026) - [CVE-2025-11739: Schneider Electric EcoStruxure Power products unsafe deserialization](https://junglewise.ai/threats/cve-2025-11739-schneider-electric-ecostruxure-power-products-unsafe) (high, CVSS 7.8, published 10 Mar 2026) - [CVE-2026-6866: Schneider Electric EcoStruxure Panel Server insecure default credentials](https://junglewise.ai/threats/cve-2026-6866-schneider-electric-ecostruxure-panel-server-insecure-default) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-6332: Schneider Electric EcoStruxure Machine Expert HVAC cleartext storage](https://junglewise.ai/threats/cve-2026-6332-schneider-electric-ecostruxure-machine-expert-hvac-cleartext) (high, CVSS 7.5, published 14 May 2026) - [CVE-2025-6625: Schneider Electric Modicon M340 improper input validation in FTP service](https://junglewise.ai/threats/cve-2025-6625-schneider-electric-modicon-m340-improper-input-validation-in-ftp) (high, CVSS 7.5, published 17 Sep 2026) - [CVE-2026-81861: Schneider Electric SCADAPack x70 insufficiently protected credentials](https://junglewise.ai/threats/cve-2026-81861-schneider-electric-scadapack-x70-insufficiently-protected) (high, CVSS 6.5, published 11 Sep 2026) - [CVE-2026-13336: Schneider Electric NetBotz 5 750/755 OS command injection and SQL injection](https://junglewise.ai/threats/cve-2026-13336-schneider-electric-netbotz-5-750-755-os-command-injection-and-sql) (high, CVSS 6.4, published 1 Sep 2026) - [CVE-2026-13348: Schneider Electric PowerChute Serial Shutdown improper authentication restriction](https://junglewise.ai/threats/cve-2026-13348-schneider-electric-powerchute-serial-shutdown-improper) (high, CVSS 5.3, published 1 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Schneider Electric technologies - [Schneider Electric PowerChute Serial Shutdown](https://junglewise.ai/threats/technologies/powerchute-serial-shutdown): 8 vulnerabilities - [Schneider Electric PowerLogic P7](https://junglewise.ai/threats/technologies/powerlogic-p7): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Schneider Electric vulnerabilities", https://junglewise.ai/threats/vendors/schneider-electric, 13 November 2026.