CVE-2026-6866 Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server
Attackers can access sensitive data and authenticate using known default credentials if the system reverts to initial settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6866?
CVE-2026-6866 is a high-severity vulnerability in Schneider Electric EcoStruxure™ Panel Server, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials.
Weakness: CWE-1188
Which versions are affected by CVE-2026-6866?
It affects 5 products.
Products include Schneider-Electric Ecostruxure Panel Server Pas400 Firmware, Schneider-Electric Ecostruxure Panel Server Pas600 Firmware, Schneider-Electric Ecostruxure Panel Server Pas600v2 Firmware, Schneider-Electric Ecostruxure Panel Server Pas800 Firmware, Schneider-Electric Ecostruxure Panel Server Pas800v2 Firmware.
How do I fix CVE-2026-6866?
No fix has been published for CVE-2026-6866 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6866 being exploited?
There is no known exploitation of CVE-2026-6866 in the wild and no public exploit code.
Sources
Also known as GHSA-rp4q-4mm5-p2vx.