CVE record · CVE-2026-4827

Insufficient Entropy vulnerability on Multiple Products

CVSS 8.7 HighEPSS 0.0031 · 24th percentile

Published by the CVE Program (CNA: schneider) at 12 May 2026, 12:24 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Schneider Electric	Easergy MiCOM C264	affected Versions D6.x affected Versions D7.33 and prior Other versions: unaffected
Schneider Electric	Easergy C5	affected Version 1.1.17 and prior Other versions: unaffected
Schneider Electric	Easergy MiCOM P30	affected P139 version prior to P139.678.700 affected P437 version prior to P437.678.700 affected P439 version prior to P439.678.700 affected P532 version prior to P532.678.700 affected P539 version prior to P539.678.700 affected P631 version prior to P631.678.700 affected P632 version prior to P632.678.700 affected P633 version prior to P633.678.700 affected P634 version prior to P634.678.700 affected P633 version P633.680.700 only affected P634 version P634.680.700 only affected P138 version prior to P138.677.700 and 4 more Other versions: unaffected
Schneider Electric	Easergy MiCOM P40	affected Series model numbers with Protocol Option bit as G, H or L and all firmware versions Other versions: unaffected
Schneider Electric	EcoStruxure™ Power Automation System Gateway (EPAS-GTW)	affected Version 6.4.616.200.100 and prior Other versions: unaffected
Schneider Electric	EcoStruxure™ Power Automation System User Interface (EPAS-UI)	affected Version 3.0.3 and prior Other versions: unaffected
Schneider Electric	EcoStruxure™ Power Operation	affected Version 2022 CU6 and prior affected Version 2024 CU2 and prior Other versions: unaffected
Schneider Electric	iPMFLS	affected Version 64.2025.0.13 and prior Other versions: unaffected
Schneider Electric	PowerLogic™ P5 Protection Relay	affected V02.502.103 and prior Other versions: unaffected
Schneider Electric	PowerLogic™ P7 Protection and Control Platform	affected V02.002.002 and prior Other versions: unaffected
Schneider Electric	PowerLogic™ T300	affected Version 2.9.4 and prior Other versions: unaffected
Schneider Electric	PowerLogic™ T500	affected Version 11.08.02 and prior Other versions: unaffected
Schneider Electric	Saitel DP	affected Version 11.06.36 and prior Other versions: unaffected
Schneider Electric	EasyLogic T150 (formerly Saitel DR)	affected Version 11.06.30 and prior Other versions: unaffected

Identifiers: CVE-2026-4827
CNA: schneider
Weakness (CWE): CWE-331
Tags: Schneider Electric Easergy MiCOM C264
Schneider Electric Easergy C5
Schneider Electric Easergy MiCOM P30
Schneider Electric Easergy MiCOM P40
Schneider Electric EcoStruxure™ Power Automation System Gateway (EPAS-GTW)
Schneider Electric EcoStruxure™ Power Automation System User Interface (EPAS-UI)
Schneider Electric EcoStruxure™ Power Operation
Schneider Electric iPMFLS
CWE-331
Published: 12 May 2026
Updated: 14 May 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.7	High	4.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	CNA (schneider)

CISA KEV Not listed.
EPSS 0.0031, the 24th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 12 May 2026. New records show when each source confirmed them.

Sources

References from the CNA

download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-02.pdf

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.