CISA Issues Advisory for ABB PCM600 Privilege Escalation and Path Traversal Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Industrial Control Systems advisory ICSA-26-274-03 regarding two vulnerabilities affecting ABB Protection and Control IED Manager PCM600. The affected product versions are ABB Protection and Control IED Manager PCM600 and earlier.

CVE-2026-15952 involves incorrect permission assignment for a critical resource. The Scheduler Service installed with PCM600 executes under the LocalSystem account. Permissions are granted to standard PCM600 users through membership in the local users group. An attacker with local access and valid user credentials may exploit this vulnerability to elevate privileges and obtain control of the affected host.

CVE-2026-15953 involves improper limitation of a pathname to a restricted directory during PCM600 project archive file processing. Insufficient validation of archive entry paths may permit path traversal during extraction, potentially allowing files to be written to locations outside the intended extraction directory.

Both vulnerabilities affect ABB Protection and Control IED Manager PCM600 versions 2.14 and earlier. The CVSS v3.1 base score for CVE-2026-15952 is 6.4 (Medium), and for CVE-2026-15953 is 5.0 (Medium). The CVSS v4.0 scores are 7.1 (High) and 5.6 (Medium), respectively.

ABB recommends the following mitigations: configure the ABBPCMSchedulerService instance to run using the same Windows account used to operate PCM600; ensure the account has the "Log on as a service" privilege; use the Scheduler tool with the same Windows account configured as the Scheduler Service logon account when IED authentication is enabled; and enable "Always trust IED security certificates" only when PCM600-to-IED communication takes place in a secure and trusted environment. ABB security advisories 2NGA003170 and 2NGA003179 provide further guidance. As of the advisory publication, no public exploit code has been confirmed for either vulnerability.