noindex and left out of the sitemap until more data is confirmed.CVE-2026-4827 is an insufficient-entropy flaw (CWE-331) in the session-management protections shared across Schneider Electric's Easergy MiCOM P30/P40 substation protection and control relays and a wide family of related bay-controller and automation products: an attacker on the network can exploit the resulting weak, predictable session tokens to gain unauthorized access, and NVD has not yet published its own Primary CVSS score — the Secondary rating shown on this page is Schneider Electric's own submission.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-05-12
Published
Vulnerability ID: CVE-2026-4827 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Schneider Electric Easergy MiCOM P30 series (P139, P437, P439, P532, P539, P631-P634) and P40 series protection and control relays, Easergy MiCOM C264/C434 bay controllers, Easergy C5, PowerLogic P5/P7 protection relays, and EcoStruxure Power Automation System Gateway/UI/Power Operation sharing the same session-management code | — | Per Schneider's security notice SEVD-2026-132-02: MiCOM C264 ≤D7.33; MiCOM P139/P437/P439/P532/P539/P631-P634 ≤678.700 or 680.700 depending on model; MiCOM P138/P436/P438/P638 ≤677.700/677.701; MiCOM C434 ≤679.700; Easergy C5 ≤1.1.17; MiCOM P40 series, all firmware with Protocol Option G, H or L enabled; EcoStruxure Power Automation System Gateway ≤6.4.616.200.100; fixed versions (e.g. MiCOM C264 D7.34, Easergy C5 1.1.18) are listed per affected model in the vendor notice |
What does this mean for affected devices?
CVE-2026-4827 (CWE-331, insufficient entropy) affects Schneider Electric's Easergy MiCOM protection relay family. NVD's description states: "CWE-331 Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session-management protections" (NVD).
The Easergy MiCOM P30 and P40 series are physical protection and control relays used in medium-, high- and extra-high-voltage substations to detect faults and trip breakers; the vulnerability was disclosed as part of a single Schneider Electric security notice spanning this relay family plus the related Easergy MiCOM C264 and C434 bay controllers, Easergy C5, PowerLogic P5/P7 protection relays and EcoStruxure Power Automation System components, all of which share the affected session-management code (Schneider Electric Security Notice SEVD-2026-132-02).
NVD tracks CVE-2026-4827 with status "Awaiting Analysis": it records only a Schneider Electric-submitted score (source [email protected]) — CVSS v4.0 8.7 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N — typed Secondary, not NVD's own Primary rating, so this page does not present that figure as NVD-confirmed (NVD).
CISA republished the vulnerability as ICSA-26-169-07 (updated 2026-09-03), independently calculating a CVSS v3.1 base score of 8.3 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) and listing the affected critical infrastructure sectors as Chemical, Critical Manufacturing, Energy, and Water and Wastewater, with worldwide deployment and an internal Schneider Electric researcher credited with discovery (CISA ICS Advisory ICSA-26-169-07).
Schneider Electric's remediation is per-model: customers with affected Easergy MiCOM C264, C434, C5, P30 or P40 relays and controllers are directed to contact Schneider Electric's Customer Care Center to obtain the fixed firmware for their specific model (for example, MiCOM C264 version D7.34 or Easergy C5 version 1.1.18), most of which require a device reboot to take effect; interim mitigations include network segmentation and reducing session-timeout duration using the vendor's CAE configuration tool (Schneider Electric Security Notice SEVD-2026-132-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0031 (24.2nd percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
NVD has not finished its own severity analysis. In the meantime, substations running an affected Easergy MiCOM relay, C264/C434 bay controller, Easergy C5, PowerLogic P5/P7 relay or EcoStruxure Power Automation System component at or below the versions listed should apply the vendor's model-specific firmware update and reduce session-timeout settings in the interim.
Evidence
- CWE-331 Insufficient Entropy vulnerability could lead to unauthorized access when an attacker on the network exploits weaknesses in session-management protections. — NVD
- Affects Easergy MiCOM P30/P40 protection relays plus related C264/C434 bay controllers, Easergy C5, PowerLogic P5/P7 and EcoStruxure Power Automation System components sharing the same session-management code; per-model affected and fixed firmware versions listed (e.g. MiCOM C264 ≤D7.33, fixed D7.34; Easergy C5 ≤1.1.17, fixed 1.1.18). — Schneider Electric Security Notice SEVD-2026-132-02
- NVD status 'Awaiting Analysis'; only a Schneider Electric-submitted Secondary CVSS v4.0 base score of 8.7 is recorded, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. — NVD
- CISA independently calculated CVSS v3.1 8.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L); affects Chemical, Critical Manufacturing, Energy, and Water and Wastewater sectors worldwide; reported by an internal Schneider Electric researcher. — CISA ICS Advisory ICSA-26-169-07
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0031 (24.2nd percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
