noindex and left out of the sitemap until more data is confirmed.CVE-2026-12927 is an out-of-bounds write in the Definition module (Def.exe) of Schneider Electric's IGSS SCADA software, version 18.0.0.26124 and earlier: importing a maliciously crafted CGF configuration-graphics file corrupts memory and can lead to code execution on the engineer's workstation. It is not on CISA's KEV list and NVD still shows it as "Awaiting Analysis" as of 2026-10-28, so this page is pending and the 7.8/8.4 figures below are Schneider Electric's own CNA submission, not an NVD-confirmed score.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-07-29
Published
Vulnerability ID: CVE-2026-12927 · Source: Schneider Electric (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Schneider Electric IGSS Definition module (Def.exe) | cpe:2.3:a:schneider-electric:igss:*:*:*:*:*:*:*:* | 18.0.0.26124 and prior (fixed in 18.0.0.26125) |
What this means
CVE-2026-12927 is an out-of-bounds write (CWE-787) in the Definition module (Def.exe) of Schneider Electric's Interactive Graphical SCADA System (IGSS). The CISA ICS advisory — a verbatim republication of Schneider Electric's own CSAF advisory SEVD-2026-195-01 — states: "Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition" (CISA ICS Advisory ICSA-26-211-04).
NVD lists the score submitted by the Schneider Electric CNA ([email protected]): CVSS v3.1 7.8 (HIGH), vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, and CVSS v4.0 8.4 (HIGH), vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (NVD). NVD's own vulnerability-status field still reads "Awaiting Analysis" as of 2026-10-28, so NVD has not published an independent score, and the CVE is not on the CISA KEV catalog. Per our indexing policy, this page therefore stays noindex with no NVD-confirmed cvss_score; the figures above are Schneider Electric's own submission, not NVD's.
We attempted to fetch Schneider Electric's own PDF advisory (SEVD-2026-195-01.pdf at download.se.com) directly, but it returned only an opaque binary PDF stream that could not be read as text, so the detail here is drawn from the CISA ICS advisory (confirmed as a verbatim republication of that same vendor document) and NVD instead. The affected product is IGSS Definition version 18.0.0.26124 and prior, fixed in 18.0.0.26125; the only mitigation documented before upgrading is to avoid importing or opening CGF files, or any other files, from untrusted sources (CISA ICS Advisory ICSA-26-211-04).
Exploitation requires user interaction (importing a file locally, UI:R/UI:A), and neither CISA nor NVD report observed in-the-wild exploitation. As of 2026-10-28, FIRST scores the probability of exploitation at 0.00184 (7.966th percentile), consistent with a local-file-import flaw with no known active exploitation (FIRST EPSS).
Until NVD completes analysis, treat the 7.8/8.4 figures as indicative only. Given SCADA engineering workstations routinely exchange configuration files with integrators and other engineers, sites running IGSS Definition should upgrade to 18.0.0.26125 and, in the meantime, treat CGF files from outside their own change-controlled process as untrusted.
Evidence
- A malicious CGF file imported into IGSS Definition (Def.exe) triggers an out-of-bounds write that could cause data loss or arbitrary code execution. — CISA ICS Advisory ICSA-26-211-04
- CVSS v3.1 7.8 (HIGH) and CVSS v4.0 8.4 (HIGH), both submitted by the Schneider Electric CNA ([email protected]); NVD vulnStatus is Awaiting Analysis as of 2026-10-28. — NVD
- Affected: IGSS Definition module 18.0.0.26124 and prior, fixed in 18.0.0.26125; CISA advisory confirmed as a verbatim republication of Schneider Electric's own SEVD-2026-195-01. — CISA ICS Advisory ICSA-26-211-04
- EPSS score is 0.00184 (7.966th percentile) as of 2026-10-28. — FIRST EPSS
