High severity · published May 14, 2026
CVE-2026-6332
Clear Text Storage of Sensitive Information on EcoStruxure™ Machine Expert HVAC
7.5
CVSS
0.1%
EPSS
No
On KEV
Description
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Ecostruxure™ Machine Expert HVAC · Schneider Electric
Versions prior to 1.10.0 · source: vendor
EM
Ecostruxure Machine Expert Hvac · Schneider-electric
before 1.10.0 · source: NVD
In the news
VulnerabilityMedium
Schnieider Electric EcoStruxure Machine Expert HVAC
View CSAF
Summary
Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 logic controllers. Failure to apply the remediation provided below may risk in revealing sensitive information, which could result in disclosing protected source code, leading to loss of confidentiality.
The following versions of Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01) are affected:
Ecostruxure™ Machine Expert HVAC vers<1.10.0
CVSS
Vendor
Equipment
Vulnerabilities
v3 5.5
Schneider Electric
Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01)
Cleartext Storage of Sensitive Information
Background
Critical Infrastructure Sectors: Chemical, Critical Manufacturing, Energy, Water and Wastewater
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
Vulnerabilities
Expand All +
CVE-2026-6332
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, when an authorized attacker accesses the source code for editing or compiling it.
View CVE Details
Affected Products
Schnieider Electric EcoS...
May 28, 2026·CISA Advisories
Affected product
EM
Ecostruxure™ Machine Expert HVAC
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6332
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6332
Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-01.pdf
More from Ecostruxure™ Machine Expert HVAC
7.5
CVE-2022-2988
A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software
