CVE-2026-2404
Received Received - Intake
Improper Output Encoding in j_security Check Causes Log Injection

Publication date: 2026-04-14

Last updated on: 2026-04-22

Assigner: Schneider Electric SE

Description
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security check request payload.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-22
Generated
2026-06-16
AI Q&A
2026-04-14
EPSS Evaluated
2026-06-15
NVD
CVE-2026-2404
EUVD
EUVD-2026-22292
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
schneider-electric powerchute_serial_shutdown to 1.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an instance of CWE-116, which involves improper encoding or escaping of output. Specifically, it occurs when an attacker modifies the payload of a POST request to /j_security_check. Due to insufficient encoding or escaping, this can lead to log injection, allowing the attacker to forge or manipulate log entries.

Impact Analysis

The vulnerability can impact you by allowing an attacker to inject malicious content into logs. This can result in forged or misleading log entries, which may hinder incident detection, forensic analysis, and auditing processes. It could also potentially be used to hide malicious activities or confuse administrators.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-2404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart