CVE-2026-4827

Insufficient Entropy vulnerability on Multiple Products

State: Published
Severity: 8.7 High
Published: May 12, 2026
Updated: May 14, 2026
Reserved: Mar 25, 2026

Description

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	schneider

Weaknesses

CWE-331 Insufficient entropy

Affected Products

Product	Versions
Easergy MiCOM C264Schneider Electric	Versions D6.xAffected Versions D7.33 and priorAffected
Easergy C5Schneider Electric	Version 1.1.17 and priorAffected
Easergy MiCOM P30Schneider Electric	P139 version prior to P139.678.700Affected P437 version prior to P437.678.700Affected P439 version prior to P439.678.700Affected P532 version prior to P532.678.700Affected P539 version prior to P539.678.700Affected P631 version prior to P631.678.700Affected P632 version prior to P632.678.700Affected P633 version prior to P633.678.700Affected P634 version prior to P634.678.700Affected P633 version P633.680.700 onlyAffected P634 version P634.680.700 onlyAffected P138 version prior to P138.677.700Affected P436 version prior to P436.677.701Affected P438 version prior to P438.677.701Affected P638 version prior to P638.677.700Affected C434 version prior to C434.679.700Affected
Easergy MiCOM P40Schneider Electric	Series model numbers with Protocol Option bit as G, H or L and all firmware versionsAffected
EcoStruxure™ Power Automation System Gateway (EPAS-GTW)Schneider Electric	Version 6.4.616.200.100 and priorAffected
EcoStruxure™ Power Automation System User Interface (EPAS-UI)Schneider Electric	Version 3.0.3 and priorAffected
EcoStruxure™ Power OperationSchneider Electric	Version 2022 CU6 and priorAffected Version 2024 CU2 and priorAffected
iPMFLSSchneider Electric	Version 64.2025.0.13 and priorAffected
PowerLogic™ P5 Protection RelaySchneider Electric	V02.502.103 and priorAffected
PowerLogic™ P7 Protection and Control PlatformSchneider Electric	V02.002.002 and priorAffected
PowerLogic™ T300Schneider Electric	Version 2.9.4 and priorAffected
PowerLogic™ T500Schneider Electric	Version 11.08.02 and priorAffected
Saitel DPSchneider Electric	Version 11.06.36 and priorAffected
EasyLogic T150 (formerly Saitel DR)Schneider Electric	Version 11.06.30 and priorAffected

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-02.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.