CVE-2026-2399 Schneider Electric CVE debrief

Who should care

Organizations using PowerChute Serial Shutdown, particularly those with Web Admin users who have access to the /REST/upssleep endpoint, should be aware of this vulnerability and take steps to mitigate it. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation and remediation.

Technical summary

The CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in PowerChute Serial Shutdown, which could cause critical files to be overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload. The CVSS v4.0 Base Score is 6.9, indicating a Medium severity. Schneider Electric has released version 1.5 of PowerChute Serial Shutdown, which addresses this vulnerability. Affected organizations should prioritize updating to version 1.5 to address the CWE-22 vulnerability, ensuring that critical files are not overwritten with text data.

Defensive priority

Organizations using PowerChute Serial Shutdown should prioritize updating to version 1.5 to address the CWE-22 vulnerability, ensuring that critical files are not overwritten with text data.

Recommended defensive actions

• Update PowerChute Serial Shutdown to version 1.5 or later
• Implement network access controls to restrict Web Admin user access
• Monitor for suspicious activity related to the /REST/upssleep endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in PowerChute Serial Shutdown, which could cause critical files to be overwritten with text data when a Web Admin user alters the POST /REST/upssleep request payload. The CVSS v4.0 Base Score is 6.9, indicating a Medium severity.

Official resources