High severity · published May 12, 2026
CVE-2026-4827
Insufficient Entropy vulnerability on Multiple Products
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Easergy C5 · Schneider Electric
Version 1.1.17 and prior · source: vendor
EM
Easergy MiCOM C264 · Schneider Electric
Versions D6.x; Versions D7.33 and prior · source: vendor
EM
Easergy MiCOM P30 · Schneider Electric
P139 version prior to P139.678.700; P437 version prior to P437.678.700; P439 version prior to P439.678.700; P532 version prior to P532.678.700; P539 version prior to P539.678.700; P631 version prior to P631.678.700; +10 more · source: vendor
EM
Easergy MiCOM P40 · Schneider Electric
Series model numbers with Protocol Option bit as G, H or L and all firmware versions · source: vendor
ET
EasyLogic T150 (formerly Saitel DR) · Schneider Electric
Version 11.06.30 and prior · source: vendor
EP
EcoStruxure™ Power Automation System Gateway (EPAS-GTW) · Schneider Electric
Version 6.4.616.200.100 and prior · source: vendor
EP
EcoStruxure™ Power Automation System User Interface (EPAS-UI) · Schneider Electric
Version 3.0.3 and prior · source: vendor
EP
EcoStruxure™ Power Operation · Schneider Electric
Version 2022 CU6 and prior; Version 2024 CU2 and prior · source: vendor
PP
PowerLogic™ P5 Protection Relay · Schneider Electric
V02.502.103 and prior · source: vendor
PP
PowerLogic™ P7 Protection and Control Platform · Schneider Electric
V02.002.002 and prior · source: vendor
PT
PowerLogic™ T300 · Schneider Electric
Version 2.9.4 and prior · source: vendor
PT
PowerLogic™ T500 · Schneider Electric
Version 11.08.02 and prior · source: vendor
In the news
VulnerabilityHigh
Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products
View CSAF
Summary
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations. Failure to apply the remediation provided below may risk improper input validation which could result in disruption of operations and access to system data.
The following versions of Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products are affected:
Easergy MiCOM C264 vers:generic/<=D7.33 (CVE-2026-4827)
Easergy MiCOM P139 vers:generic/<=P139.678.700 (CVE-2026-4827)
Easergy MiCOM P437 vers:generic/<=P437.678.700 (CVE-2026-4827)
Easergy MiCOM P439 vers:generic/<=P439.678.700 (CVE-2026-4827)
Easergy MiCOM P532 vers:generic/<=P532.678.700 (CVE-2026-4827)
Easergy MiCOM P539 vers:generic/<=P539.678.700 (CVE-2026-4827)
Easergy MiCOM P631 vers:generic/<=P631.678.700 (CVE-2026-4827)
Easergy MiCOM P632 vers:generic/<=P632.678.700 (CVE-2026-4827)
Easergy MiCOM P633 vers:generic/<=P633.678.700 (CVE-2026-4827)
Easergy MiCOM P634 vers:generic/<=P634.678.700 (CVE-2026-4827)
Easergy MiCOM P633 P633.680.700 (CVE-2026-4827)
Easergy MiCOM P634 P634.680.700 (CVE-2026-4827)
Easergy MiCOM P138 vers:generic/<=P138.677.700 (CVE-2026-4827)
...
Jun 18, 2026·CISA Advisories