CVE-2026-6866 is an insecure-default-initialization flaw in Schneider Electric EcoStruxure Panel Server (PAS400/600/600V2/800/800V2) where, under rare circumstances, device credentials revert to their initial factory settings, letting a remote attacker with no credentials of their own authenticate using those known defaults and gain unauthorized access to the panel server.
Vulnerability summary
CVSS base score
7.5
High severity
EPSS score (FIRST)
0.5%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2026-6866 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Schneider Electric EcoStruxure Panel Server | cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas400_firmware:*:*:*:*:*:*:*:* | PAS400, PAS600, PAS600V2, PAS800, PAS800V2: all firmware through 002.005.000 (fixed in 002.006.000) |
What does this mean for affected devices?
CVE-2026-6866 is an initialization of a resource with an insecure default (CWE-1188) in Schneider Electric's EcoStruxure Panel Server line. NVD's own analysis describes it as a flaw that "could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials" (NVD).
NVD lists this CVE as fully analyzed (status "Analyzed") and has itself assigned a CVSS v3.1 base score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality once an attacker logs in with the reverted default credentials; Schneider Electric's own CVSS v4.0 submission scores it 8.2 (NVD).
CISA's advisory ICSA-26-160-03, released 2026-06-09, confirms the affected models (PAS400, PAS600, PAS600V2, PAS800, PAS800V2) run firmware 002.005.000 or earlier and recommends upgrading to 002.006.000, which requires a device reboot to take effect (CISA ICS Advisory ICSA-26-160-03). Schneider Electric's own security notice SEVD-2026-132-04 covers the same fix and version boundary (Schneider Electric SEVD-2026-132-04).
CISA's advisory states the condition occurs only "in rare circumstances" and recommends network segmentation and firewalling of control-system devices as compensating controls where immediate patching is not possible (CISA ICS Advisory ICSA-26-160-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.0049 (41.1th percentile) — low, consistent with a condition that CISA itself describes as occurring only rarely rather than being broadly, reliably exploitable (CISA KEV, FIRST EPSS).
Because exploitation requires no credentials and no user interaction once the default-credential condition occurs, EcoStruxure Panel Server operators should upgrade to firmware 002.006.000 as soon as a maintenance window allows and keep panel servers off any network segment reachable without a firewall in the meantime.
Evidence
- Insecure default initialization (CWE-1188): credentials can revert to initial factory settings in rare circumstances, letting a remote attacker authenticate with known defaults. — NVD
- CVSS v3.1 base score 7.5 (NVD-assigned, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), status Analyzed; Schneider Electric's own CVSS v4.0 submission scores it 8.2. — NVD
- Affects EcoStruxure Panel Server PAS400/600/600V2/800/800V2 firmware through 002.005.000, fixed in 002.006.000 (reboot required); occurs only in rare circumstances per CISA. — CISA ICS Advisory ICSA-26-160-03
- Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
- EPSS score is 0.0049 (41.1th percentile) as of 2026-10-22. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Under what conditions does this credential-reversion flaw actually occur?
CISA's advisory states the condition — credentials reverting to their initial factory settings — occurs only "in rare circumstances," not as a reliably reproducible attack path, which is consistent with the advisory's own compensating-control recommendation rather than an emergency recall (per CISA ICS Advisory ICSA-26-160-03).
What does an attacker gain if the rare credential-reversion condition occurs?
A remote attacker with no credentials of their own can authenticate using the known, reverted default credentials and gain unauthorized access to the panel server — NVD scores this a high (7.5) confidentiality impact with no direct integrity or availability impact (per NVD).
Why do NVD and Schneider Electric list different severity scores?
NVD itself assigned a CVSS v3.1 base score of 7.5, while Schneider Electric's own CVSS v4.0 submission for the same flaw scores it somewhat higher at 8.2 (per NVD).
What should operators do about affected Panel Server units?
Upgrade to firmware 002.006.000, which requires a device reboot to take effect, and in the meantime keep panel servers off any network segment that is not firewalled, per CISA's compensating-control recommendation for devices that cannot be patched immediately (per CISA ICS Advisory ICSA-26-160-03).
Questions about this page?