High severity · published May 14, 2026
CVE-2026-6332
Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC
7.5
CVSS
0.1%
EPSS
No
On KEV
Description
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Ecostruxure™ Machine Expert HVAC · Schneider Electric
Versions prior to 1.10.0 · source: vendor
In the news
VulnerabilityMedium
Schnieider Electric EcoStruxure Machine Expert HVAC
View CSAF Summary Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 logic controllers. Failure to apply the remediation provided below may risk in revealing sensitive information, which could result in disclosing protected source code, leading to loss of confidentiality. The following versions of Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01) are affected: Ecostruxure™ Machine Expert HVAC vers<1.10.0 CVSS Vendor Equipment Vulnerabilities v3 5.5 Schneider Electric Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01) Cleartext Storage of Sensitive Information Background Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater Countries/Areas Deployed: Worldwide Company Headquarters Location: France Vulnerabilities Expand All + CVE-2026-6332 CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, when an authorized attacker accesses the source code for editing or compiling it. View CVE Details Affected Products Schnieider Electric EcoS...
May 28, 2026·CISA Advisories
Affected product
EM
Ecostruxure™ Machine Expert HVAC
Schneider Electric
More from Ecostruxure™ Machine Expert HVAC
7.5
CVE-2022-2988
A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software