Vulnerability · Published Sep 11, 2026 · Assigned by schneider
CVE-2026-81861
Medium 5.9
In plain English
A medium-severity security flaw in SCADAPack 32 from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 4.0)5.9Medium
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | SCADAPack 47x | All versions |
| Schneider Electric | SCADAPack 47xi | All versions |
| Schneider Electric | SCADAPack 47xd | All versions |
| Schneider Electric | SCADAPack 470R | All versions |
| Schneider Electric | SCADAPack 57x | All versions |
| Schneider Electric | SCADAPack 3xx | All versions |
| Schneider Electric | SCADAPack 32 | All versions |
Weakness: CWE-522 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N