CVE-2026-1286Disclosure(schneider-electric / ecostruxure_foxboro_dcs_control_software)

MEDIUMCVSS 6.5 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for schneider-electric ecostruxure_foxboro_dcs_control_software systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.

schneider-electric CVEs Back to dashboard

5.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-069-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-069-03.pdf

Weakness type (CWE)

CWE-502

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

ecostruxure_foxboro_dcs_control_software

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-03-16); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

schneider-electric

Products

ecostruxure_foxboro_dcs_control_software

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

Active Exploitation

150.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-16	1	Disclosure1
2026-03-25	1	Active Exploitation1

Full discourse2 posts

Aviatrix Threat Research Center@aviatrixtrc199d
Active Exploitation
Attackers exploiting CVE-2026-1286 in Schneider Electric's Foxboro DCS gain remote code execution through malicious project files, then pivot laterally across industrial networks. Runtime segmentation helps contain post-compromise activity in critical infrastructure environments. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/schneider-electric-2026-foxboro-dcs-deserialization-vulnerability
Post summary
Attackers are actively using CVE-2026-1286 to achieve remote code execution against Schneider Electric’s Foxboro DCS through malicious project files, then pivoting laterally in industrial networks. A full analysis is available at the provided link, detailing the deserialization flaw and containment measures.
0000041
1.9K followersView on X
CVE@CVEnew209d
Disclosure
CVE-2026-1286 CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation… https://www.cve.org/CVERecord?id=CVE-2026-1286
Post summary
The post announces CVE‑2026‑1286, describing a deserialization vulnerability that could lead to remote code execution on workstations, but provides no proof of concept, exploit code, active exploitation evidence, or patch information.
00000180
56.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	schneider-electric	ecostruxure_foxboro_dcs_control_software	-	-	-

Explore more

Back to dashboard schneider-electric CVEs ecostruxure_foxboro_dcs_control_software vulnerabilities