CVE-2026-2402 - CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints

Back Back to CVE browser

MEDIUM

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints

Published Apr 14, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on a sequence of requests to multiple endpoints.

Affected products

Vendor Schneider Electric Product PowerChute™ Serial Shutdown Default
unaffected
- Version
  Versions v1.4 and prior
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Schneider Electric

PowerChute™ Serial Shutdown

unaffected

Version	Status	Constraints
Versions v1.4 and prior	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-307

References (2)

Link	Providers	Tags
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-104-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-104-01.pdf		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22288		Advisory