High severity · published Sep 9, 2026
CVE-2026-19233
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged…
8.6
CVSS
0.6%
EPSS
No
On KEV
Description
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server data when an attacker with a privileged account sends crafted, unvalidated parameters to a server endpoint.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EI
EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert) · Schneider Electric
Versions 9.1.2 and prior · source: vendor
Affected product
EI
EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19233
download.se.com
https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-251-01.pdf
More from EcoStruxure™ IT Data Center Expert (Formerly known as StruxureWare Data Center Expert)
8.6
CVE-2026-8044
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a…
7.5
CVE-2025-13957
CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator…