Skip to content
Fencer Vulns
high 8.7

CVE-2026-4827 json

Insufficient Entropy vulnerability on Multiple Products

published 2026-05-12 5 mo ago modified 2026-10-26 13 d ago also EUVD-2026-29459

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-169-07 updated cvss 8.3

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

  • Schneider Electric Easergy C5 <= 1.1.17
    affected: vendor fix
  • Schneider Electric Easergy MiCOM C264 <= D7.33 Schneider Electric Easergy MiCOM C434 <= C434.679.700
    affected: vendor fix, mitigation
  • Schneider Electric Easergy MiCOM P40 Series
    affected: mitigation
  • Schneider Electric Easergy MiCOM P138 <= P138.677.700 Schneider Electric Easergy MiCOM P139 <= P139.678.700
    affected: vendor fix, mitigation
  • Schneider Electric Easergy MiCOM P436 <= P436.677.701 Schneider Electric Easergy MiCOM P437 <= P437.678.700 Schneider Electric Easergy MiCOM P438 <= P438.677.701
    affected: mitigation
  • Schneider Electric Easergy MiCOM P439 <= P439.678.700
    affected: vendor fix, mitigation
  • Schneider Electric Easergy MiCOM P532 <= P532.678.700
    affected: mitigation
  • Schneider Electric Easergy MiCOM P539 <= P539.678.700
    affected: vendor fix, mitigation
show 7 more
  • Schneider Electric Easergy MiCOM P631 <= P631.678.700
    affected: mitigation
  • Schneider Electric Easergy MiCOM P632 <= P632.678.700 Schneider Electric Easergy MiCOM P633 <= P633.678.700, P633.680.700 Schneider Electric Easergy MiCOM P634 <= P634.678.700, P634.680.700
    affected: vendor fix, mitigation
  • Schneider Electric Easergy MiCOM P638 <= P638.677.700
    affected: mitigation
  • Schneider Electric EasyLogic T150 (formerly Saitel DR) EasyLogic T150 (formerly Saitel DR) <= 11.06.30 Schneider Electric EcoStruxure Power Automation System Gateway (EPAS-GTW) <= 6.4.616.200.100 Schneider Electric EcoStruxure Power Automation System User Interface (EPAS-UI) <= 3.0.3
    affected: vendor fix
  • Schneider Electric EcoStruxure Power Operation <= 2022_CU6, <= 2024_CU2
    affected: vendor fix community.se.com
  • Schneider Electric iPMFLS <= 64.2025.0.13 Schneider Electric PowerLogic P5 Protection Relay <= 02.502.103 Schneider Electric PowerLogic P7 Protection and Control Platform <= 02.002.002 Schneider Electric PowerLogic T300 <= 2.9.4 Schneider Electric PowerLogic T500 <= 11.08.02 Schneider Electric Saitel DP Saitel DP <= 11.06.36
    affected: vendor fix
  • Schneider Electric Easergy C5 1.1.18 Schneider Electric Easergy MiCOM C264 D7.34 Schneider Electric Easergy MiCOM C434 C434.679.700 Schneider Electric Easergy MiCOM P138 P138.677.701 Schneider Electric Easergy MiCOM P139 version P139.678.700 Schneider Electric Easergy MiCOM P439 P439.678.700
    +7 more products
    Schneider Electric Easergy MiCOM P539 P539.678.700 Schneider Electric Easergy MiCOM P632 P632.678.700 Schneider Electric Easergy MiCOM P633 P633.680.701, P633.678.700 Schneider Electric Easergy MiCOM P634 P634.680.701 Schneider Electric EasyLogic T150 (formerly Saitel DR) Saitel DR 11.06.31 Schneider Electric EcoStruxure Power Automation Automation System User Interface (EPAS-UI) 3.0.4 Schneider Electric EcoStruxure Power Automation System Gateway (EPAS-GTW) 6.4.610.500.101
    fixed

8 more fixed in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
5 mo ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Schneider Electric Easergy MiCOM C264
  • Schneider Electric Easergy C5
  • Schneider Electric Easergy MiCOM P30
  • Schneider Electric Easergy MiCOM P40
  • Schneider Electric EcoStruxure™ Power Automation System Gateway (EPAS-GTW)
  • Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI)
  • Schneider Electric EcoStruxure™ Power Operation
  • Schneider Electric iPMFLS
  • Schneider Electric PowerLogic™ P5 Protection Relay
  • Schneider Electric PowerLogic™ P7 Protection and Control Platform
  • Schneider Electric PowerLogic™ T300
  • Schneider Electric PowerLogic™ T500
  • Schneider Electric Saitel DP
  • Schneider Electric EasyLogic T150 (formerly Saitel DR)

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.