Improper Output Encoding in j_security Check Causes Log Injection

Publication date: 2026-04-14

Last updated on: 2026-04-22

Assigner: Schneider Electric SE

Description

CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security check request payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-14

Last Modified

2026-04-22

Generated

2026-07-06

AI Q&A

2026-04-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-2404

EUVD

EUVD-2026-22292

Affected Vendors & Products

Vendor	Product	Version / Range
schneider-electric	powerchute_serial_shutdown	to 1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability is an instance of CWE-116, which involves improper encoding or escaping of output. Specifically, it occurs when an attacker modifies the payload of a POST request to /j_security_check. Due to insufficient encoding or escaping, this can lead to log injection, allowing the attacker to forge or manipulate log entries.

Impact Analysis

The vulnerability can impact you by allowing an attacker to inject malicious content into logs. This can result in forged or misleading log entries, which may hinder incident detection, forensic analysis, and auditing processes. It could also potentially be used to hide malicious activities or confuse administrators.

Hi! I’m here to help you understand CVE-2026-2404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70