How severe is CVE-2026-2405?

CVE-2026-2405 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-2405 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-2405?

CVE-2026-2405 affects Schneider-electric Powerchute Serial Shutdown. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-2405?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-2405 have an EU (EUVD) identifier?

Yes. CVE-2026-2405 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-22293.

When was CVE-2026-2405 published?

CVE-2026-2405 was published on 2026-04-14 and last updated on 2026-06-17.

CVE-2026-2405

CVE-2026-2405 is a medium-severity vulnerability in Schneider-electric Powerchute Serial Shutdown with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v4: 5.3
EPSS exploit prediction: 0% (16th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-22293
Weakness: CWE-400
Affected product: Schneider-electric Powerchute Serial Shutdown
Published: 2026-04-14
Last modified: 2026-06-17

Description

CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.

Frequently asked questions

What is CVE-2026-2405?: CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user floods the system with POST /helpabout requests.
How severe is CVE-2026-2405?: CVE-2026-2405 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-2405 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (16th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-2405?: CVE-2026-2405 affects Schneider-electric Powerchute Serial Shutdown. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-2405?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-2405 have an EU (EUVD) identifier?: Yes. CVE-2026-2405 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-22293.
When was CVE-2026-2405 published?: CVE-2026-2405 was published on 2026-04-14 and last updated on 2026-06-17.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf

Affected products (1)

cpe:2.3:a:schneider-electric:powerchute_serial_shutdown:*:*:*:*:*:*:*:*

More vulnerabilities in Schneider-electric Powerchute Serial Shutdown

CVE-2026-2399 — Medium (CVSS 6.1): CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could…
CVE-2026-2404 — Medium (CVSS 5.3): CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when…
CVE-2026-2402 — Medium (CVSS 5.3): CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to…
CVE-2026-2401 — Medium (CVSS 5.0): CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential…
CVE-2026-2403 — Medium (CVSS 4.3): CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log…
CVE-2026-2400 — Medium (CVSS 4.3): CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application…

All CVEs affecting Schneider-electric Powerchute Serial Shutdown →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →