High severity · published May 12, 2026
CVE-2026-6866
Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
EcoStruxure™ Panel Server · Schneider Electric
Versions 002.005.000 and prior · source: vendor
EP
Ecostruxure Panel Server Pas400 Firmware · Schneider-electric
before 002.006.000 · source: NVD
EP
Ecostruxure Panel Server Pas600 Firmware · Schneider-electric
before 002.006.000 · source: NVD
EP
Ecostruxure Panel Server Pas600v2 Firmware · Schneider-electric
before 002.006.000 · source: NVD
EP
Ecostruxure Panel Server Pas800 Firmware · Schneider-electric
before 002.006.000 · source: NVD
EP
Ecostruxure Panel Server Pas800v2 Firmware · Schneider-electric
before 002.006.000 · source: NVD
