Schneider Electric IGSS: 1 CVE, High 7.8
Summary
CISA reports 1 vulnerability in Schneider Electric IGSS, IGSS Definition (Def.exe) module. Weakness type: Out-of-bounds Write. Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The [IGSS](https://igss.schneider-electric.com/) product is a state-of-the-art SCADA system used for monitoring and controlling industrial processes. Highest CVSS v3 score: 7.8 (High), not remotely exploitable per its CVSS vector.
At a glance
- Vendor
- Schneider Electric
- Products
- IGSS, IGSS Definition (Def.exe) module
- CVEs
- CVE-2026-12927
- Highest CVSS v3
- 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Energy
- Deployed
- Worldwide
- Vendor HQ
- France
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-12927 | Out-of-bounds Write | 7.8 | – | No | CVE-2026-12927 |
Affected products (3)
- IGSS
- IGSS Definition (Def.exe) module version 18.0.0.26124 and prior
- IGSS Definition (Def.exe) module version 18.0.0.26125
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Version 18.0.0.26125 of the IGSS Definition module includes a fix for this vulnerability and is available for download through IGSS Master > Update IGSS Software or here: https://igss.schneider-electric.com/igss/igssupdates/v180/IGSSUPDATE.ZIP link
- Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Avoid executing commands, importing or opening files from untrusted sources.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-211-04
- Machine-readable CSAF record
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-195-01&p_enDocType=Secur
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-195-01&p_enDocType=Secur
- https://www.se.com/ww/en/download/document/7EN52-0390/
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.