CVE-2026-81861Patch

MEDIUMCVSS 5.9 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-251-03.pdf

Weakness type (CWE)

CWE-522

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 1d ago at 3 mentions (2026-09-15); latest day: 1
4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Active Exploitation

125.0%

Disclosure

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-15	3	Active Exploitation1Disclosure1Patch1
2026-09-17	1	Patch1

Full discourse4 posts

Marcus@Owenby44d
Patch
CISA has republished a Schneider advisory on SCADAPack x70 RTUs (CVE-2026-81861). Weak credential protection on a legacy lock feature. Worst case: unauthorized access to RTU config. These boxes sit on remote monitoring and control paths across energy and critical manufacturing. Same lesson as the HV iron story: the asset isn’t only steel and windings. It’s firmware, access control, and whether the control surface is on the open internet. CISA’s recommendation : RBAC, segmentation, firewall the device, don’t leave Secure Lock as your security model. https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-04
Post summary
CISA republished a Schneider advisory for CVE-2026-81861 on SCADAPack x70 RTUs, citing weak credential protection on a legacy lock feature; CISA recommends RBAC, segmentation, and firewalling as mitigations, with no PoC, exploit tool, or active-exploitation claim mentioned.
00030144
1.2K followersView on X
NewsTongue@NewsTongueX46d
Patch
🔴 Schneider Electric SCADAPack RTUs vulnerable to credential theft across critical infrastructure Schneider Electric disclosed a vulnerability (CVE-2026-81861) affecting SCADAPack x70 Remote Terminal Units deployed worldwide in critical manufacturing and energy sectors. The flaw involves insufficiently protected credentials in the Secure Lock functionality, enabling unauthorized RTU configuration access and potential loss of confidentiality. Affected models: SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 — all versions compromised. • Replace Secure Lock with Role-Based Access Control (RBAC), documented in SCADAPack security guidelines
Post summary
The post discloses Schneider Electric SCADAPack RTU credential protection issue CVE-2026-81861 and provides a mitigation step to replace Secure Lock with RBAC documented in security guidelines.
0000046
899 followersView on X
CyberWorldOps@CyberWorldOps46d
Disclosure
Schneider Electric CVE-2026-81861 in SCADAPack x70 RTUs exposes credentials via legacy Secure Lock, risking unauthorized access. Details: https://cyberworldops.eu/en/schneider-electric-scadapack-credential-flaw-exposes-rtu #ICSsecurity #SCADA https://cyberworldops.eu/en/schneider-electric-scadapack-credential-flaw-exposes-rtu
Post summary
The post announces CVE-2026-81861, describing it as a credential exposure flaw in Schneider Electric SCADAPack x70 RTUs, and includes a link to further information.
0000047
10 followersView on X
Aviatrix Threat Research Center@aviatrixtrc46d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2026-81861 in Schneider Electric SCADAPack RTUs to access industrial control systems through weak authentication. Once inside, they moved laterally between RTU devices and established persistent command channels. Runtime segmentation helps contain such post-compromise activity in critical infrastructure networks. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/schneider-electric-scadapack-x70-cve-2026-81861-credentials-vulnerability
Post summary
The text reports active exploitation of CVE-2026-81861 in Schneider Electric SCADAPack RTUs through weak authentication, enabling lateral movement and persistent access to industrial control systems.
0000064
2.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-81861

Marcus[verified]@OwenbyPatch

CISA republished a Schneider advisory for CVE-2026-81861 on SCADAPack x70 RTUs, citing weak credential protection on a legacy lock feature; CISA recommends RBAC, segmentation, and firewalling as mitigations, with no PoC, exploit tool, or active-exploitation claim mentioned.

NewsTongue[verified]@NewsTongueXPatch

The post discloses Schneider Electric SCADAPack RTU credential protection issue CVE-2026-81861 and provides a mitigation step to replace Secure Lock with RBAC documented in security guidelines.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

The text reports active exploitation of CVE-2026-81861 in Schneider Electric SCADAPack RTUs through weak authentication, enabling lateral movement and persistent access to industrial control systems.

CyberWorldOps@CyberWorldOpsDisclosure

The post announces CVE-2026-81861, describing it as a credential exposure flaw in Schneider Electric SCADAPack x70 RTUs, and includes a link to further information.