CVE-2026-6866: Schneider EcoStruxure Panel Server Creds

CVE-2026-6866 is an insecure-default-initialization flaw in Schneider Electric EcoStruxure Panel Server (PAS400/600/600V2/800/800V2) where, under rare circumstances, device credentials revert to their initial factory settings, letting a remote attacker with no credentials of their own authenticate using those known defaults and gain unauthorized access to the panel server.

CVE-2026-6866 is an initialization of a resource with an insecure default (CWE-1188) in Schneider Electric's EcoStruxure Panel Server line. NVD's own analysis describes it as a flaw that "could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials" (NVD).

NVD lists this CVE as fully analyzed (status "Analyzed") and has itself assigned a CVSS v3.1 base score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality once an attacker logs in with the reverted default credentials; Schneider Electric's own CVSS v4.0 submission scores it 8.2 (NVD).

CISA's advisory ICSA-26-160-03, released 2026-06-09, confirms the affected models (PAS400, PAS600, PAS600V2, PAS800, PAS800V2) run firmware 002.005.000 or earlier and recommends upgrading to 002.006.000, which requires a device reboot to take effect (CISA ICS Advisory ICSA-26-160-03). Schneider Electric's own security notice SEVD-2026-132-04 covers the same fix and version boundary (Schneider Electric SEVD-2026-132-04).

CISA's advisory states the condition occurs only "in rare circumstances" and recommends network segmentation and firewalling of control-system devices as compensating controls where immediate patching is not possible (CISA ICS Advisory ICSA-26-160-03).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-22, and FIRST scores the probability of exploitation at 0.0049 (41.1th percentile) — low, consistent with a condition that CISA itself describes as occurring only rarely rather than being broadly, reliably exploitable (CISA KEV, FIRST EPSS).

Because exploitation requires no credentials and no user interaction once the default-credential condition occurs, EcoStruxure Panel Server operators should upgrade to firmware 002.006.000 as soon as a maintenance window allows and keep panel servers off any network segment reachable without a firewall in the meantime.

• Insecure default initialization (CWE-1188): credentials can revert to initial factory settings in rare circumstances, letting a remote attacker authenticate with known defaults. — NVD
• CVSS v3.1 base score 7.5 (NVD-assigned, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), status Analyzed; Schneider Electric's own CVSS v4.0 submission scores it 8.2. — NVD
• Affects EcoStruxure Panel Server PAS400/600/600V2/800/800V2 firmware through 002.005.000, fixed in 002.006.000 (reboot required); occurs only in rare circumstances per CISA. — CISA ICS Advisory ICSA-26-160-03
• Not present in the CISA KEV catalog as of 2026-10-22. — CISA KEV
• EPSS score is 0.0049 (41.1th percentile) as of 2026-10-22. — FIRST EPSS