What’s Vulnerable › Vulnerabilities
CVE-2026-4827: Insufficient Entropy vulnerability on Multiple Products
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-12 · updated 2026-10-26
- Weakness: CWE-331
Description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Affected products
- Schneider Electric Easergy C5: through Version 1.1.17
- Schneider Electric Easergy MiCOM C264: through Versions D7.33; Versions D6.x
- Schneider Electric Easergy MiCOM P30: from P139 version prior through P139.678.700; from P437 version prior through P437.678.700; from P439 version prior through P439.678.700; from P532 version prior through P532.678.700; from P539 version prior through P539.678.700; from P631 version prior through P631.678.700
- Schneider Electric Easergy MiCOM P40: Series model numbers with Protocol Option bit as G, H or L and all firmware versions
- Schneider Electric EasyLogic T150 (formerly Saitel DR): through Version 11.06.30
- Schneider Electric EcoStruxure™ Power Automation System Gateway (EPAS-GTW): through Version 6.4.616.200.100
- Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI): through Version 3.0.3
- Schneider Electric EcoStruxure™ Power Operation: through Version 2022 CU6; through Version 2024 CU2
- Schneider Electric iPMFLS: through Version 64.2025.0.13
- Schneider Electric PowerLogic™ P5 Protection Relay: through V02.502.103
- Schneider Electric PowerLogic™ P7 Protection and Control Platform: through V02.002.002
- Schneider Electric PowerLogic T300: through Version 2.9.4
- Schneider Electric PowerLogic™ T500: through Version 11.08.02
- Schneider Electric Saitel DP: through Version 11.06.36
References
Get alerted when CVE-2026-4827 or the next vulnerability affects your stack