CVE-2026-6866: Schneider Electric Ecostruxure Panel Server PAS400 Firmware

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.

Affected products

• Schneider Electric Ecostruxure Panel Server PAS400 Firmware: before 002.006.000 (fixed in 002.006.000)
• Schneider Electric Ecostruxure Panel Server PAS600 Firmware: before 002.006.000 (fixed in 002.006.000)
• Schneider Electric Ecostruxure Panel Server PAS600V2 Firmware: before 002.006.000 (fixed in 002.006.000)
• Schneider Electric Ecostruxure Panel Server PAS800 Firmware: before 002.006.000 (fixed in 002.006.000)
• Schneider Electric Ecostruxure Panel Server PAS800V2 Firmware: before 002.006.000 (fixed in 002.006.000)

Published 2026-05-12. Last modified 2026-06-24.