Vulnerability · Published Jul 29, 2026 · Assigned by schneider
CVE-2026-0667
Critical 9.3
In plain English
A critical-severity security flaw in RemoteConnect from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.5%top 54.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | SCADAPack 47x | Versions prior to R3.4.2 (Firmware version prior to 9.12.2) |
| Schneider Electric | SCADAPack 47xi | Versions prior to R3.4.2 (Firmware version prior to 9.12.2) |
| Schneider Electric | SCADAPack 57x | All Versions |
| Schneider Electric | RemoteConnect | Versions prior to R3.4.2 |
Weakness: CWE-754 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N