Schneider Electric patches weak-randomness flaw across dozens of grid control products

Key points

• Schneider Electric has issued fixes for CVE-2026-4827, a weak-randomness flaw that could let an attacker hijack logged-in sessions on industrial control gear.
• The bug carries a CVSS severity score of 8.3 out of 10 and affects Easergy, EcoStruxure, PowerLogic and Saitel product lines used in electricity, water and chemical plants.
• Vulnerable kit includes MiCOM protection relays, EcoStruxure Power Operation SCADA software, Easergy C5 bay controllers and more than a dozen other product families.
• The advisory was published via CISA and lists fixed versions for most product families, with the P40 series flagged across all firmware.
• Operators must contact Schneider's local Application Center to update devices, and a reboot is required.

Schneider Electric has pushed fixes for a vulnerability running through a huge swathe of its grid and substation gear, from small protection relays to full SCADA (software that lets operators monitor and control a power system from a screen).

The flaw, tracked as CVE-2026-4827, is what engineers call insufficient entropy. The products generate the secret numbers behind login sessions in a way that's too predictable. An attacker sitting on the same network can guess or replay those numbers, take over an authenticated session, then issue commands as if they were a real operator. CVSS severity: 8.3 out of 10. We first reported on this CVE on 3 September, and this update reflects additional product families now confirmed affected.

What kit is affected?

The list is long. Affected products span MiCOM C264 and C434 bay controllers, MiCOM P139, P437, P439, P532, P539, P631 through P634, P138, P436, P438 and P638 relays, EcoStruxure Power Automation Gateway and User Interface (EPAS-GTW and EPAS-UI), EcoStruxure Power Operation (EPO, the on-premises SCADA package), iPMFLS load-shedding software, PowerLogic P5 and P7 relays, PowerLogic T300 and T500 RTUs (remote terminal units), Easergy C5, and the Saitel DP and EasyLogic T150 RTUs.

The MiCOM P40 series is vulnerable across every firmware version. Some P40 units will need a hardware or configuration change, not just a firmware update.

Should the public worry?

Not directly, and not today. These devices sit inside substations, water treatment plants and industrial sites. They're not reachable from the open internet in a properly run network. The real failure mode is an attacker who already has a foothold on the operational network, through a contractor laptop, a jump host or a poorly segmented IT-to-OT link, then pivoting to grid controls. That's not theoretical. It's the exact pattern behind every serious ICS incident of the last decade, and it's why our August ICS Patch Tuesday roundup flagged network segmentation as the common thread across Siemens, Schneider and Phoenix Contact flaws.

How do operators fix it?

You can't just click update. Schneider is routing patches through its Customer Care Center and local Application Centers, and every fix requires a device reboot. For a live protection relay that means a planned outage window and coordination with the network operator.

The post-mortem, if this ever gets exploited, will note that the patch existed for months and no change window ever opened. That's the boring, real reason ICS bugs linger.

What should asset owners do now?

Inventory first. Pull firmware versions across any Easergy, EcoStruxure, PowerLogic or Saitel gear and match them against the advisory list. Then audit network segmentation between corporate IT and the OT network, and check who can reach management interfaces. Session hijacking only matters if someone unauthorised can reach the login.

Treat this as a segmentation audit with a patch attached, not a patch with a segmentation footnote.