Schneider Electric PowerChute Serial Shutdown: 1 CVE, Medium 5.3
Summary
CISA reports 1 vulnerability in Microsoft, Red Hat, SUSE, Schneider Electric PowerChute™ Serial Shutdown, Windows, Enterprise Linux. Weakness type: Improper Restriction of Excessive Authentication Attempts. Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Highest CVSS v3 score: 5.3 (Medium), exploitable over the network.
At a glance
- Vendor
- Microsoft, Red Hat, SUSE, Schneider Electric
- Products
- PowerChute™ Serial Shutdown, Windows, Enterprise Linux
- CVEs
- CVE-2026-13348
- Highest CVSS v3
- 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Critical Manufacturing, Energy, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- France
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-13348 | Improper Restriction of Excessive Authentication Attempts | 5.3 | – | No | CVE-2026-13348 |
Affected products (5)
- PowerChute™ Serial Shutdown Version 1.5 and prior
- PowerChute™ Serial Shutdown Version 1.6
- Microsoft Windows
- Red Hat Enterprise Linux
- SUSE Enterprise Linux
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Version v1.6 of PowerChute™ Serial Shutdown includes a fix for these vulnerabilities and is available for download here: • Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ Reboot needed: Upon installation, the service is automatically restarted. A customer can validate a successful install by checking the version information in the Control Panel or on the About page within PCSS after logging in. Specific instructions and hardening guidelines for these remediations can be found in the [Security Handbook](https://download.se.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN). link
- Vendor Fix: Version v1.6 of PowerChute™ Serial Shutdown includes a fix for these vulnerabilities and is available for download here: • Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/ Reboot needed: Upon installation, the service is automatically restarted. A customer can validate a successful install by checking the version information in the Control Panel or on the About page within PCSS after logging in. Specific instructions and hardening guidelines for these remediations can be found in the [Security Handbook](https://download.se.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN). link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-260-07
- Machine-readable CSAF record
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-01&p_enDocType=Secur
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-223-01&p_enDocType=Secur
- https://www.se.com/ww/en/download/document/7EN52-0390
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.