CVE-2026-2402
Received Received - Intake
Improper Authentication Restriction in Multi-Endpoint Access Allows Account Takeover

Publication date: 2026-04-14

Last updated on: 2026-04-22

Assigner: Schneider Electric SE

Description
CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-04-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-2402
EUVD
EUVD-2026-22288
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
schneider-electric powerchute_serial_shutdown to 1.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an improper restriction of excessive authentication attempts, classified as CWE-307. It allows an attacker to repeatedly try different credentials across multiple endpoints without limitation, potentially gaining unauthorized access to a user account.

Impact Analysis

The vulnerability can lead to unauthorized access to user accounts by allowing attackers to perform unlimited authentication attempts. This can result in compromised accounts, data breaches, and potential misuse of user information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart