CVE-2026-6866 HIGH

CVE-2026-6866: Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server

Vendor Schneider Electric
Product EcoStruxure™ Panel Server
Weakness CWE-1188
Published May 12, 2026
Last update May 12, 2026

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

Key dates

02Disclosure timeline

May 12, 2026 CVE published
May 12, 2026 Record updated