noindex and left out of the sitemap until more data is confirmed.CVE-2026-15952 is a privilege-escalation flaw in ABB's PCM600 engineering tool: its Scheduler Service runs as the high-privilege LocalSystem account while standard PCM600 users already have permission to modify it, letting a local user escalate to that privilege level; NVD has not yet completed its own CVSS scoring or CPE mapping, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2026-09-28
Published
Vulnerability ID: CVE-2026-15952 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| ABB Protection and Control IED Manager (PCM600) | — | through 2.14 (per ABB advisories 2NGA003170 / 2NGA003179); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-15952 is an incorrect permission assignment for a critical resource (CWE-732) in ABB's Protection and Control IED Manager (PCM600), a Windows engineering tool used to configure protection and control relays. The Scheduler Service "executes under the LocalSystem account while permissions are granted to standard PCM600 users through membership in the local users group," so any local account with ordinary PCM600 access can modify or replace what that privileged service runs (CISA ICS Advisory ICSA-26-274-03).
NVD tracks CVE-2026-15952 with status "Deferred" as of 2026-10-21: it has recorded ABB's own CNA-submitted scores — CVSS v3.1 6.4 (medium), vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, and CVSS v4.0 7.1 (high) — but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting ABB's figure as NVD-confirmed (NVD).
CISA's advisory ICSA-26-274-03, published 2026-10-01, states the issue affects PCM600 versions through 2.14 and that ABB is offering workarounds rather than a version patch — configuring the Scheduler Service to run under the same Windows account as PCM600, and restricting certificate trust settings — documented in ABB advisories 2NGA003170 and 2NGA003179 (CISA ICS Advisory ICSA-26-274-03).
Exploitation requires local access with valid standard-user credentials; CISA's advisory reports no known public exploitation of this CVE (CISA ICS Advisory ICSA-26-274-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.0009 (0.5th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, PCM600 operators should apply ABB's documented Scheduler Service and certificate-trust workarounds and restrict who holds standard PCM600 accounts on engineering workstations.
Evidence
- PCM600 Scheduler Service runs as LocalSystem while standard PCM600 users already have permission to modify it (CWE-732). — CISA ICS Advisory ICSA-26-274-03
- NVD status is "Deferred" with ABB-submitted CVSS v3.1 6.4 / v4.0 7.1, no NVD-published score or CPE configuration as of 2026-10-21. — NVD
- Affects PCM600 through version 2.14; ABB provides workarounds (service account change, certificate trust restriction) rather than a patched version, per ABB advisories 2NGA003170 / 2NGA003179. — CISA ICS Advisory ICSA-26-274-03
- Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
- EPSS score is 0.0009 (0.5th percentile) as of 2026-10-21. — FIRST EPSS
