CVE-2026-9717 Command injection in PowerLogic™ P7

High 8.6 Published 25 Jun 2026 Updated 25 Jun 2026

Privileged authenticated users can execute arbitrary OS commands with elevated privileges on Schneider Electric PowerLogic P7 devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-9717?

CVE-2026-9717 is a high-severity command injection vulnerability in Schneider Electric PowerLogic™ P7, published on 25 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service.

Weakness: CWE-78

Which versions are affected by CVE-2026-9717?

It affects 1 product.

Products include Schneider-Electric Powerlogic P7 Firmware.

How do I fix CVE-2026-9717?

No fix has been published for CVE-2026-9717 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-9717 being exploited?

There is no known exploitation of CVE-2026-9717 in the wild and no public exploit code.

Sources

Also known as GHSA-47f2-rprg-7x63.