PT-2026-32676 · Schneider Electric · Powerchute Serial Shutdown

Published 2026-04-14 · Updated 2026-04-19 · CVE-2026-2404

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Improper encoding or escaping of output allows an attacker to perform log injection and forge logs by altering the payload of the 'POST /j security check' request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-07588

CVE-2026-2404

Affected Products

Powerchute Serial Shutdown

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2404 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07588 · Security Note
• https://twitter.com/CVEnew/status/2045889788536852823 · Twitter Post
• https://twitter.com/infoflowcloud/status/2045891232698622443 · Twitter Post