Improper Authentication Restriction in Multi-Endpoint Access Allows Account Takeover

Publication date: 2026-04-14

Last updated on: 2026-04-22

Assigner: Schneider Electric SE

Description

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-14

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-2402

EUVD

EUVD-2026-22288

Affected Vendors & Products

Vendor	Product	Version / Range
schneider-electric	powerchute_serial_shutdown	to 1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper restriction of excessive authentication attempts, classified as CWE-307. It allows an attacker to repeatedly try different credentials across multiple endpoints without limitation, potentially gaining unauthorized access to a user account.

Impact Analysis

The vulnerability can lead to unauthorized access to user accounts by allowing attackers to perform unlimited authentication attempts. This can result in compromised accounts, data breaches, and potential misuse of user information.

Hi! I’m here to help you understand CVE-2026-2402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70