High 8.7Published May 12, 2026

CVE-2026-4827Insufficient Entropy vulnerability on Multiple Products

Updated under an hour ago (Oct 27, 2026, 2:30 AM ET)

Does this affect you?

It affects Schneider Electric Easergy MiCOM C264 and 13 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Schneider Electric Easergy MiCOM C264

Exploited in the last 30 days

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Weakness (CWE): CWE-331
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: schneider
NVD analysis: Awaiting Analysis
Record last updated: May 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Schneider Electric Easergy MiCOM C264 schneider_electric:easergy_micom_c264 (from the name)	Versions D6.x; Versions D7.33 and prior	CNA record
Schneider Electric Easergy C5 schneider_electric:easergy_c5 (from the name)	Version 1.1.17 and prior	CNA record
Schneider Electric Easergy MiCOM P30 schneider_electric:easergy_micom_p30 (from the name)	P139 version prior to P139.678.700; P437 version prior to P437.678.700; P439 version prior to P439.678.700; P532 version prior to P532.678.700; P539 version prior to P539.678.700; P631 version prior to P631.678.700; P632 version prior to P632.678.700; P633 version prior to P633.678.700; and 8 more ranges	CNA record
Schneider Electric Easergy MiCOM P40 schneider_electric:easergy_micom_p40 (from the name)	Series model numbers with Protocol Option bit as G, H or L and all firmware versions	CNA record
Schneider Electric EcoStruxure™ Power Automation System Gateway (EPAS-GTW) schneider_electric:ecostruxuretm_power_automation_system_gateway_epas_gtw (from the name)	Version 6.4.616.200.100 and prior	CNA record
Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI) schneider_electric:ecostruxuretm_power_automation_system_user_interface_epas_ui (from the name)	Version 3.0.3 and prior	CNA record
Schneider Electric EcoStruxure™ Power Operation schneider_electric:ecostruxuretm_power_operation (from the name)	Version 2022 CU6 and prior; Version 2024 CU2 and prior	CNA record
Schneider Electric iPMFLS schneider_electric:ipmfls (from the name)	Version 64.2025.0.13 and prior	CNA record
Schneider Electric PowerLogic™ P5 Protection Relay schneider_electric:powerlogictm_p5_protection_relay (from the name)	V02.502.103 and prior	CNA record
Schneider Electric PowerLogic™ P7 Protection and Control Platform schneider_electric:powerlogictm_p7_protection_and_control_platform (from the name)	V02.002.002 and prior	CNA record
1–10 of 14

References

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-02.pdf

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.