Schneider Electric PowerChute Serial Shutdown Flaw Allows Unauthorized Account Access

Schneider Electric has published a security advisory (SEVD-2026-223-01) detailing a vulnerability in its PowerChute Serial Shutdown (PCSS) UPS management software. The product is widely used for graceful system shutdown and energy management across desktops, servers, and workstations in critical infrastructure sectors.

The vulnerability, identified as CVE-2026-13348, stems from an improper restriction of excessive authentication attempts (CWE-307). According to the advisory, an attacker could exploit this flaw by performing an arbitrary number of authentication attempts when redirect handling is disabled, potentially gaining unauthorized access to a user account. Successful exploitation could lead to disruption of operations and access to system data.

The issue affects PowerChute Serial Shutdown version 1.5 and prior. Schneider Electric has released version 1.6, which includes a fix for the vulnerability. The update is available for both Windows and Linux platforms. After installation, the service restarts automatically; users can verify the update by checking the version information in the Control Panel or the About page within PCSS.

The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It requires no privileges and no user interaction, but the attack complexity is low, and the impact is limited to confidentiality.

Schneider Electric recommends that organizations apply the update promptly and follow general cybersecurity best practices, including network segmentation, physical security controls, and minimizing exposure of control systems to the internet.