Is CVE-2026-13348 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-13348

Organizations should upgrade to PowerChute Serial Shutdown version 1.6, available for Windows and Linux. After installation, the service restarts automatically; verify the version via the Control Panel or About page. Additionally, follow Schneider Electric's recommended cybersecurity best practices, including network segmentation, physical security controls, and minimizing exposure of control systems to the internet.

Quick answers

What is CVE-2026-13348?: Organizations should upgrade to PowerChute Serial Shutdown version 1.6, available for Windows and Linux. After installation, the service restarts automatically; verify the version via the Control Panel or About page. Additionally, follow Schneider Electric's recommended cybersecurity best practices, including network segmentation, physical security controls, and minimizing exposure of control systems to the internet.
How severe is CVE-2026-13348?: medium, CVSS 5.3
Is CVE-2026-13348 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-13348 be mitigated?: Organizations should upgrade to PowerChute Serial Shutdown version 1.6, available for Windows and Linux. After installation, the service restarts automatically; verify the version via the Control Panel or About page. Additionally, follow Schneider Electric's recommended cybersecurity best practices, including network segmentation, physical security controls, and minimizing exposure of control systems to the internet.

CVSS

5.3

Vendor

Schneider Electric

Published

Sep 30, 2026 · 08:05

Patch

Unknown / not confirmed

Affected products

PowerChute Serial Shutdown

Mitigation

Schneider Electric PowerChute Serial Shutdown Flaw Allows Unauthorized Account Access

Schneider Electric has disclosed a medium-severity vulnerability in its PowerChute Serial Shutdown product, tracked as CVE-2026-13348. The flaw, an improper restriction of excessive authentication attempts (CWE-307), could allow an attacker to perform unlimited login attempts and gain unauthorized access to user accounts when redirect handling is disabled. The vendor has released version 1.6 to remediate the issue.

—2m

CVE-2026-13348

Quick answers

Related News

Schneider Electric PowerChute Serial Shutdown Flaw Allows Unauthorized Account Access