High severity · published Sep 9, 2026
CVE-2026-77120
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and…
8.7
CVSS
0.7%
EPSS
No
On KEV
Description
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PT
PowerLogic T300 · Schneider Electric
Versions 2.9.8-5620 and prior · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-77120
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-77120
download.se.com
https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-251-02.pdf
More from PowerLogic T300
8.7
CVE-2026-4827
Insufficient Entropy vulnerability on Multiple Products