CVE-2026-2399 Schneider Electric CVE debrief

Who should care

Organizations using PowerChute Serial Shutdown, particularly those with Web Admin users who have access to the /REST/upssleep endpoint, should be aware of this vulnerability and take steps to mitigate it. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation and remediation.

Technical summary

The CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in PowerChute Serial Shutdown, which could cause critical files to be overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload. The CVSS v4.0 Base Score is 6.9, indicating a Medium severity. Schneider Electric has released version 1.5 of PowerChute Serial Shutdown, which addresses this vulnerability. Affected organizations should prioritize updating to version 1.5 to address the CWE-22 vulnerability, ensuring that critical files are not overwritten with text data.

Defensive priority

Organizations using PowerChute Serial Shutdown should prioritize updating to version 1.5 to address the CWE-22 vulnerability, ensuring that critical files are not overwritten with text data.

Recommended defensive actions

• Update PowerChute Serial Shutdown to version 1.5 or later
• Implement network access controls to restrict Web Admin user access
• Monitor for suspicious activity related to the /REST/upssleep endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in PowerChute Serial Shutdown, which could cause critical files to be overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload. The CVSS v4.0 Base Score is 6.9, indicating a Medium severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.