Vulnerability · Published Apr 14, 2026 · Assigned by schneider
CVE-2026-2402
Medium 6.9
In plain English
A medium-severity security flaw in PowerChute™ Serial Shutdown from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 80.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | PowerChute™ Serial Shutdown | Versions v1.4 and prior |
Weakness: CWE-307 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N