Schneider patches PowerLogic P7 command-execution and DoS flaws
Firmware is the easy part; live electrical operations still have to find the reboot window CISA does not provide.
TL;DR
CISA posted an ICS advisory for Schneider Electric PowerLogic P7 versions 0.2.003.001.000 and prior, with firmware V02.004.001 available and a reboot required. The high-severity issues, CVE-2026-9716 and CVE-2026-9717, cover HMI/configuration denial of service and privileged authenticated command execution; CISA also lists CVE-2026-9718, a medium denial-of-service flaw. Energy, critical manufacturing and commercial facilities get concrete mitigations, but no staged reboot guidance.
CISA’s PowerLogic P7 advisory is a patch notice with an outage-planning problem attached. Schneider Electric has firmware V02.004.001 for P7 versions 0.2.003.001.000 and earlier, but the advisory says the remediation needs a reboot. On a protection and control platform for complex electrical network applications, that reboot belongs in the operational schedule.
The high-severity issues are CVE-2026-9716 and CVE-2026-9717. The first can render HMI and configuration functionality unavailable when malformed requests hit exposed network interfaces. The second can allow unauthorized command execution with elevated privileges when a privileged authenticated user interacts with a vulnerable network-exposed service. CISA also lists CVE-2026-9718, a medium reachable-assertion denial-of-service vulnerability. The common thread is loss of availability or command control around equipment whose job is to keep electrical operations controllable.
Operators have something to do before the firmware window. CISA and Schneider tell customers to restrict access to P7 service endpoints on ports 8080 and 3702, monitor anomalous SOAP requests targeting wsApp, and apply least privilege to users interacting with P7. Those are useful compensating controls, especially because one high-severity bug requires no privileges while the command-injection issue requires high privileges.
The concentration point is the part procurement diagrams tend to hide. CISA identifies P7 deployments in commercial facilities, critical manufacturing and energy worldwide. It has also issued recent Schneider PowerLogic-family advisories for energy deployments and for commercial facilities, critical manufacturing and energy deployments worldwide (https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-02; https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-06). This advisory alone cannot rank Schneider against peers. It does show grid hardening work keeps returning to the same vendor control surfaces, ports, services and reboot windows.
Published ·Deep Fathom