High severity · published May 12, 2026
CVE-2026-6865
Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Products
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller · Schneider Electric
Versions 11.06.31 and prior · source: vendor
SD
Saitel DP Remote Terminal Unit & Controller · Schneider Electric
Versions 11.06.36 and prior · source: vendor
In the news
VulnerabilityHigh
Schneider Electric EasyLogic T150 and Saitel DP
View CSAF
Summary
Successful exploitation this vulnerability could allow an attacker to gain unauthorized access to sensitive files
The following versions of Schneider Electric EasyLogic T150 and Saitel DP are affected:
Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Firmware installed on Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (All versions) vers:semver/<=11.06.31 (CVE-2026-6865)
Schneider Electric Saitel DP Remote Terminal Unit & Controller Firmware installed on Schneider Electric Saitel DP Remote Terminal Unit & Controller (All versions) vers:semver/<=11.06.36 (CVE-2026-6865)
CVSS
Vendor
Equipment
Vulnerabilities
v3 7.1
Schneider Electric
Schneider Electric EasyLogic T150 and Saitel DP
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Background
Critical Infrastructure Sectors: Energy, Critical Manufacturing
Countries/Areas Deployed: Worldwide
Company Headquarters Location: France
Vulnerabilities
Expand All +
CVE-2026-6865
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing.
View CVE Details
Affected Products
Schneider Electric EasyLogic T150...
Jun 18, 2026·CISA Advisories
Affected product
ET
EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-6865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-6865
download.schneider-electric.com
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-03.pdf
More from EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller
7.5
CVE-2026-9650
CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses…
4.4
CVE-2026-9651
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an…