CVE-2026-4827
Vulnérabilité élevée dans Easergy MiCOM C264 (Schneider Electric)
CVSS 8.7 · Élevée
EPSS 0.4%
Schneider Electric•Easergy MiCOM C264•Versions : P437 version prior to P437.678.700, P634 version prior to P634.678.700, P139 version prior to P139.678.700, Version 11.06.36 and prior, V02.002.002 and prior, C434 version prior to C434.679.700, V02.502.103 and prior, Version 2022 CU6 and prior, P638 version prior to P638.677.700, P439 version prior to P439.678.700, Series model numbers with Protocol Option bit as G, H or L and all firmware versions, Version 64.2025.0.13 and prior, Version 3.0.3 and prior, P138 version prior to P138.677.700, P631 version prior to P631.678.700, P539 version prior to P539.678.700, Version 6.4.616.200.100 and prior, P634 version P634.680.700 only, P436 version prior to P436.677.701, Version 11.06.30 and prior, Versions D7.33 and prior, Version 2024 CU2 and prior, Version 1.1.17 and prior, Version 2.9.4 and prior, P632 version prior to P632.678.700, P438 version prior to P438.677.701, P532 version prior to P532.678.700, P633 version prior to P633.678.700, Versions D6.x, P633 version P633.680.700 only, Version 11.08.02 and prior
Description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Gravité et risque d'exploitation
CVE-2026-4827 obtient un score CVSS de 8.7/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.43 %, ce qui la place devant 35.6 % des CVE référencées.
Que faire ?
- Vérifiez si Easergy MiCOM C264 (versions P437 version prior to P437.678.700, P634 version prior to P634.678.700, P139 version prior to P139.678.700, Version 11.06.36 and prior, V02.002.002 and prior, C434 version prior to C434.679.700, V02.502.103 and prior, Version 2022 CU6 and prior, P638 version prior to P638.677.700, P439 version prior to P439.678.700, Series model numbers with Protocol Option bit as G, H or L and all firmware versions, Version 64.2025.0.13 and prior, Version 3.0.3 and prior, P138 version prior to P138.677.700, P631 version prior to P631.678.700, P539 version prior to P539.678.700, Version 6.4.616.200.100 and prior, P634 version P634.680.700 only, P436 version prior to P436.677.701, Version 11.06.30 and prior, Versions D7.33 and prior, Version 2024 CU2 and prior, Version 1.1.17 and prior, Version 2.9.4 and prior, P632 version prior to P632.678.700, P438 version prior to P438.677.701, P532 version prior to P532.678.700, P633 version prior to P633.678.700, Versions D6.x, P633 version P633.680.700 only, Version 11.08.02 and prior) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.