CVE-2026-6866
Full vulnerability record from the local CVENow database.
Description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Severity
HIGH
CVSS score
8.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-12 15:16:16.570000
Last modified
2026-10-26 18:10:00.173000
View original CVE JSON
{
"id": "CVE-2026-6866",
"sourceIdentifier": "[email protected]",
"published": "2026-05-12T15:16:16.570",
"lastModified": "2026-10-26T18:10:00.173",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad CWE-1188 de Inicialización de un Recurso con un Valor Predeterminado Inseguro que podría causar la divulgación no autorizada de información sensible cuando las credenciales revierten a la configuración inicial en raras circunstancias, permitiendo la autenticación no autorizada utilizando credenciales conocidas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Schneider Electric",
"product": "EcoStruxure™ Panel Server",
"defaultStatus": "unaffected",
"modules": [
"PAS400",
"PAS600",
"PAS600V2",
"PAS800",
"PAS800V2"
],
"versions": [
{
"version": "Versions 002.005.000 and prior",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-12T15:43:29.539824Z",
"id": "CVE-2026-6866",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1188"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas400_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "002.006.000",
"matchCriteriaId": "E5078B07-2122-45AA-883A-55FF3DE93DD0"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27D73E17-C55C-4C2E-A5CC-226ACE91399A"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "002.006.000",
"matchCriteriaId": "D7434A33-C704-4328-B820-166FB25F035D"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7195AA1-21BB-42D0-9B32-4B344FC93266"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas600v2_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "002.006.000",
"matchCriteriaId": "DDF21A37-34B5-4C5D-8A4E-A3817D6104B3"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas600v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "879BE61A-9A2B-4363-A923-37F4E5C7D8B8"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "002.006.000",
"matchCriteriaId": "A9E339A6-DF66-4D19-BADE-E087189E2107"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas800:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A749B94C-FA81-4615-A0E0-29E0DF8705FC"
}
]
}
]
},
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:schneider-electric:ecostruxure_panel_server_pas800v2_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "002.006.000",
"matchCriteriaId": "0D3E83F4-9C4C-4B20-ACDC-CD62B65AA006"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:schneider-electric:ecostruxure_panel_server_pas800v2:-:*:*:*:*:*:*:*",
"matchCriteriaId": "68962BDE-FE56-4368-8A84-A4F1C9681781"
}
]
}
]
}
],
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-04.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}