PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1762 GE Vernova CVE debrief

CVE-2026-1762 affects GE Vernova Enervista UR Setup versions prior to 8.70. CISA’s advisory says the installer can be abused for DLL hijacking when it is run from a location containing unknown or untrusted DLLs, which can result in code execution with administrative privileges. The practical risk is highest on systems used to deploy or maintain OT/ICS engineering software, especially where installers are staged in shared or writable locations. GE Vernova recommends upgrading to version 8.70 or later.

Vendor
GE Vernova
Product
Enervista UR Setup
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-17
Original CVE updated
2026-02-17
Advisory published
2026-02-17
Advisory updated
2026-02-17

Who should care

OT/ICS administrators, GE Vernova Enervista UR Setup users, workstation imaging and deployment teams, and anyone who runs the installer with elevated rights or from shared/writable directories.

Technical summary

The advisory describes a DLL hijacking weakness in the Enervista UR Setup installer for versions before 8.70. The supplied CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a locally exploitable issue with low attack complexity and the potential for high confidentiality, integrity, and availability impact. The source material points to CWE-427 as a relevant weakness class, and the remediation is to use Enervista UR Setup 8.70 or later.

Defensive priority

High. This is an installer-time privilege escalation/code execution risk with a vendor patch available, so environments that deploy or maintain the software should prioritize upgrade and install-path hygiene.

Recommended defensive actions

  • Upgrade GE Vernova Enervista UR Setup to version 8.70 or later.
  • Do not run the installer from directories that contain unknown or untrusted DLLs.
  • Stage installers only in trusted, controlled locations with restricted write access.
  • Limit who can write to installation media, deployment shares, and working directories used for software installs.
  • Use least privilege for installation workflows and only elevate when required.
  • Apply CISA ICS recommended practices and related defense-in-depth guidance on systems that host or deploy OT software.

Evidence notes

The supplied CISA CSAF advisory (ICSA-26-048-03) states that Enervista UR Setup versions prior to 8.70 are vulnerable to DLL hijacking and that an attacker could obtain code execution with administrative privileges when the installer is run in a location with unknown or untrusted DLLs. The advisory’s remediation section recommends version 8.70 or later. The CVSS vector supplied in the source is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The provided corpus also includes official references to the CISA advisory, the CVE record, GE Vernova remediation page, and CISA ICS guidance resources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-1762 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-1762

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-1762 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-1762

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-048-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-048-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.