Medium severity · published Oct 27, 2026
CVE-2026-41022
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices
New
5.9
CVSS
0.1%
EPSS
No
On KEV
Description
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 0% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
easySoft · Eaton
before 8.46 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41022
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41022
www.eaton.com
https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-va-2026-1017.pdf
More from easySoft
7.8
CVE-2020-6656
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability
7.8
CVE-2020-6655
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability
6.5
CVE-2023-43777
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays
6.1
CVE-2026-22614
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine…