CVE-2026-14354

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-10-23
Weakness: CWE-522

Description

CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to compromise of managed devices, when a local privileged attacker leverages weaknesses in the handling and protection of stored credentials within the application.

Affected products

Schneider Electric EcoStruxure™ Cybersecurity Admin Expert (CAE): through v4.2.0

References

https://download.se.com/files?p_Doc_Ref=SEVD-2026-195-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-195-02.pdf

Get alerted when CVE-2026-14354 or the next vulnerability affects your stack