CVE-2026-6866: Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-1188

Description

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

Affected products

Schneider-Electric Ecostruxure Panel Server Pas400 Firmware: before 002.006.000 — fixed in 002.006.000
Schneider-Electric Ecostruxure Panel Server Pas600 Firmware: before 002.006.000 — fixed in 002.006.000
Schneider-Electric Ecostruxure Panel Server Pas600V2 Firmware: before 002.006.000 — fixed in 002.006.000
Schneider-Electric Ecostruxure Panel Server Pas800 Firmware: before 002.006.000 — fixed in 002.006.000
Schneider-Electric Ecostruxure Panel Server Pas800V2 Firmware: before 002.006.000 — fixed in 002.006.000

How to fix

Upgrade to a fixed version: Schneider-Electric Ecostruxure Panel Server Pas400 Firmware 002.006.000; Schneider-Electric Ecostruxure Panel Server Pas600 Firmware 002.006.000; Schneider-Electric Ecostruxure Panel Server Pas600V2 Firmware 002.006.000; Schneider-Electric Ecostruxure Panel Server Pas800 Firmware 002.006.000; Schneider-Electric Ecostruxure Panel Server Pas800V2 Firmware 002.006.000. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf

Get alerted when CVE-2026-6866 or the next vulnerability affects your stack