Advisories
Schneider Electric PowerChute Serial Shutdown Vulnerability (CVE‑2026‑13348) – Immediate Patch Required
Schneider Electric’s PowerChute Serial Shutdown UPS management software is affected by a CVE‑2026‑13348 flaw that allows unlimited authentication attempts when redirect handling is disabled. The issue could enable attackers to bypass login controls and disrupt critical infrastructure operations. Versions up to 1.5 and 1.6 are impacted; the vendor’s v1.6 patch restores proper authentication limits. Operators must download and install the update for Windows and Linux immediately, then verify the new version via the Control Panel or PCSS About page.
Schneider Electric’s PowerChute Serial Shutdown is a widely deployed UPS management suite that orchestrates graceful shutdowns and energy savings across desktops, servers, and workstations. A newly disclosed flaw—CVE‑2026‑13348—has been identified as an improper restriction of excessive authentication attempts (CWE‑307). When redirect handling is disabled, attackers can repeatedly try credentials, potentially gaining unauthorized access.
Impact
- Unauthorized account access on affected systems
- Potential disruption of critical infrastructure operations
- Risk to commercial facilities, manufacturing, energy, and IT sectors worldwide
Affected Versions
All PowerChute Serial Shutdown releases up to and including version 1.5, as well as 1.6, are vulnerable.
Remediation
Schneider Electric has released a fixed build, v1.6, for both Windows and Linux platforms. The update automatically restarts the PCSS service upon installation. After applying the patch, verify success by checking the version number in the Control Panel or the PCSS About page.
"Customers are urged to apply the v1.6 update immediately to mitigate the risk of unauthorized access and operational disruption."
Next Steps for Operators
- Download the latest v1.6 update from Schneider Electric’s support portal.
- Schedule a maintenance window to apply the patch on all affected UPS management nodes.
- Confirm the patch by reviewing the PCSS version information.
- Review hardening guidelines in the Security Handbook to strengthen authentication controls.
Related vulnerabilities
Schneider Electric SCADAPack x70 RTU Vulnerability (CVE‑2026‑81861) – Urgent RBAC Migration Needed
Schneider Electric’s SCADAPack x70 series – including the 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 models – is affected by CVE‑2026‑81861. The flaw stems from insufficiently protected credentials that allow attackers to hijack the Secure Lock feature and gain unauthorized access to RTU configuration. The vulnerability carries a CVSS score of 6.5 and threatens critical manufacturing and energy infrastructures worldwide. Immediate remediation requires disabling legacy Secure Lock, enabling Role‑Based Access Control (RBAC), and applying standard hardening measures such as network segmentation and
Read briefing
Privilege‑Escalation Vulnerability in Windows 11 (CVE‑2026‑85921) – Immediate Patch Required
A newly disclosed flaw in Windows 11 (CVE‑2026‑85921) lets attackers elevate privileges on ARM64 and x64 systems running versions older than 10.0.28000.2956. The issue was identified by France’s CERT-FR and detailed in Microsoft’s security bulletin. Patching to the latest cumulative update or upgrading to a supported build is mandatory to neutralise the risk.
Read briefing
Microsoft Office for Mac RCE Vulnerability CVE-2026-88196 – Update Required
Microsoft released a patch for a remote code execution flaw (CVE-2026-88196) affecting Office for Mac. Admins should install the update immediately; other Office products are unaffected.
Read briefing
CVE-2026-12345: CPython Data Integrity Vulnerability – Immediate Patch Required
A critical data‑integrity flaw (CVE‑2026‑12345) was disclosed in CPython, allowing attackers to corrupt program state. Systems running unpatched CPython versions are at risk. Apply the PSF‑2026‑42 patch and verify the update immediately.
Read briefing