PowerChute Authentication Flaw Opens the Door to Unlimited Login Attempts

Network-reachable weakness affects UPS management software

Schneider Electric has disclosed an authentication-control vulnerability in PowerChute Serial Shutdown, its software for managing uninterruptible power supplies, coordinating graceful shutdowns, and monitoring energy use across desktops, servers, and workstations.

Tracked as CVE-2026-13348, the flaw can allow an unauthenticated remote attacker to make an arbitrary number of login attempts under a specific configuration condition. Successful password guessing could provide unauthorized access to a PCSS user account and expose system data.

Schneider Electric initially released its advisory on August 11, 2026. CISA published its initial republication on September 17, 2026, converting the vendor’s CSAF material into an ICS advisory.

The vulnerability carries a CVSS v3.1 base score of 5.3, placing it in the Medium severity range. Its vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

No exploitation, compromised organizations, or affected deployments have been reported. The advisory also provides no indicators of compromise. It does not state that CVE-2026-13348 has been added to CISA’s Known Exploited Vulnerabilities catalog, and no KEV remediation deadline is specified.

Repeated authentication attempts are not adequately restricted

CVE-2026-13348 is categorized as CWE-307, Improper Restriction of Excessive Authentication Attempts. This class of weakness appears when an application does not sufficiently slow, limit, or stop repeated efforts to authenticate.

In PowerChute Serial Shutdown, the vulnerable behavior occurs when redirect handling is disabled. Under that condition, an attacker can submit an arbitrary number of authentication attempts instead of being effectively constrained by the application’s login protections.

The attack is remotely executable over a network and has low complexity. It requires no existing account, prior privileges, or action from a legitimate user. Those characteristics make exposed PCSS interfaces particularly relevant during risk assessment, even though the overall CVSS score is Medium.

Unlimited attempts do not automatically disclose a password. They can, however, make password guessing and credential-reuse attacks more practical, especially where accounts use weak, predictable, or previously compromised credentials.

The advisory does not explain why redirect handling might be disabled, whether that state is common in production, or whether an attacker can influence it remotely. It also does not specify any request pattern, rate threshold, logging behavior, or reliable telemetry that defenders could use to identify exploitation.

The scored technical impact is limited to confidentiality:

• Confidentiality: Low
• Integrity: None
• Availability: None
• Scope: Unchanged

Schneider Electric nevertheless warns that leaving the issue uncorrected could affect operational continuity and access to system data. That broader warning should not be read as a scored direct denial-of-service capability. Rather, unauthorized access to software involved in UPS and shutdown management could create operational risk depending on the account’s permissions and the surrounding deployment.

Version information requires careful verification

The affected-version information contains an apparent inconsistency that administrators should resolve against their installed build and Schneider Electric’s advisory.

The product summary associates CVE-2026-13348 with PowerChute Serial Shutdown versions 1.5 and earlier, as well as version 1.6. However, the affected-product section identifies version 1.5 and prior as known affected, while Schneider Electric’s remediation guidance says version 1.6 contains the correction.

Based on the remediation instructions, customers running version 1.5 or an earlier release should move to version 1.6. Organizations already reporting version 1.6 should not rely solely on the displayed major and minor version numbers. They should confirm that the installed package is the corrected build referenced by Schneider Electric.

Separate installers are available for Windows and Linux:

• Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/
• Linux: https://www.se.com/ww/en/download/document/SPD-PCSS_LNX_EN/

PCSS is deployed worldwide, including in Commercial Facilities, Critical Manufacturing, Energy, and Information Technology environments. Its operational role means that administrators should evaluate both the vulnerability itself and the availability implications of updating software connected to UPS infrastructure.

Updating to version 1.6 is the primary remediation

Schneider Electric’s recommended correction is PowerChute Serial Shutdown version 1.6. The installation process automatically restarts the PCSS service; the available guidance does not describe a separate operating-system reboot as necessary.

Administrators should still plan for the service restart. Before deployment, they should review dependencies, current UPS-management activity, and any local procedures governing maintenance of operational systems.

After installation, the deployed version can be checked in either of two places:

1. The operating system’s Control Panel.
2. The About page within PCSS after authentication.

Because of the conflicting version references, validation should include confirmation that the package came from Schneider Electric’s designated download location. Merely seeing “1.6” in an inventory record may not be sufficient if the organization cannot establish which build was installed.

The related vendor advisory is titled “Improper Restriction of Excessive Authentication Attempts vulnerability on PowerChute Serial Shutdown - SEVD-2026-223-01” and is available in CSAF and PDF formats. Schneider Electric’s Security Handbook provides additional installation and hardening instructions.

Reduce access to PCSS while patching proceeds

Where immediate installation is not possible, network controls can reduce the opportunity for remote password guessing. PCSS systems and associated control environments should not be directly reachable from the public Internet.

Schneider Electric and CISA recommend placing control-system networks and remote devices behind firewalls, separating them from business networks, and minimizing all unnecessary exposure. Remote administration should use a secured mechanism such as a VPN, with both the VPN software and connecting endpoint kept updated.

These controls do not correct CVE-2026-13348. They narrow the number of systems capable of reaching the authentication interface.

Administrators should also consider the following measures:

• Restrict PCSS access to explicitly authorized management hosts and network segments.
• Review account passwords for strength, uniqueness, and possible reuse elsewhere.
• Examine authentication logs for unusually high volumes of failed login attempts, while recognizing that no vulnerability-specific indicators have been published.
• Apply physical access controls around industrial-control and safety systems.
• Keep controllers in locked cabinets and avoid leaving them in Program mode.
• Prevent programming software from connecting to networks unrelated to its intended device.
• Scan USB drives, optical media, and other mobile-data mechanisms before using them on isolated networks.
• Prevent unsanitized mobile devices that have connected to other networks from accessing safety or control environments.

Any network or access-control change should be preceded by an impact analysis. Defensive measures that interrupt legitimate UPS management or shutdown coordination may introduce their own operational hazards.

Defenders have no published exploitation markers

Schneider Electric CPCERT reported the vulnerability to CISA, but neither organization has described attacks exploiting it. There are no disclosed victim organizations, malicious addresses, request signatures, filenames, or other concrete indicators for threat hunters to search.

Monitoring should therefore focus on behavior: repeated authentication failures, attempts originating from unauthorized network segments, unusual access to PCSS accounts, and account activity inconsistent with established administrative patterns.

Suspected malicious activity should be handled through the organization’s incident-response process. Relevant findings can also be reported to CISA for correlation with activity observed in other environments.

Until more technical evidence becomes available, the strongest response is straightforward: verify the exact PCSS build, install the corrected version 1.6 package, limit network reachability, and scrutinize repeated login failures.