Schneider Electric SEVD-2026-286-01: Pro-face STW6000 and Harmony STW6 all versions — CVE-2026-96434 (CVSS 3.1 8.8 / CVSS 4.0 8.6) unmaintained third-party components can give unauthorised control if a user browses malicious web pages

Schneider Electric published security notification SEVD-2026-286-01 on 13 October 2026 for its Pro-face STW6000 and Harmony STW6 basic web HMI panels (Harmony ST6 / Pro-face ST6000 range). CVE-2026-96434 is CWE-1104 (use of unmaintained third-party components): Schneider says failure to apply the listed mitigations may allow various attack scenarios from third-party component obsolescence, including unauthorised control of the device and operational failures, when a user visits malicious web pages for browsing. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); CVSS 4.0 base is 8.6. All versions of both products are listed as known affected. The advisory does not publish a fixed firmware build for this CVE; remediations are mitigations — run the HMI only in a protected environment, minimise network exposure and keep panels off the internet, plus Schneider's standard ICS hygiene guidance. A second same-day notice, SEVD-2026-286-02, covers SAGE RTU CVE-2026-102250 (CVSS 7.2, privileges required high) with a firmware fix in C3414-500-S02L0. No exploitation is stated. Primary: Schneider Electric SEVD-2026-286-01 CSAF/JSON.

Product

Schneider Electric Pro-face STW6000 and Harmony STW6 basic web HMI panels

Versions

All versions of Pro-face STW6000 and Harmony STW6 listed known affected; no fixed build published for CVE-2026-96434 in SEVD-2026-286-01

CVSS

8.8 (CVSS 3.1); 8.6 (CVSS 4.0)

Exploited in Australia?

unknown

Patch to

Apply Schneider's mitigations immediately: operate the HMI only in a protected environment, isolate control networks, keep panels off the internet, and follow Schneider Recommended Cybersecurity Best Practices. For SAGE RTU separately, install firmware C3414-500-S02L0 (reboot required) per SEVD-2026-286-02. Contact your Schneider representative for install-specific guidance.

Primary: Schneider Electric — Security notifications (SEVD-2026-286-01, 13 Oct 2026) · Vendor: Schneider Electric SEVD-2026-286-01 PDF (Pro-face STW6000 / Harmony STW6) · CVE: CVE-2026-96434, CVE-2026-102250 · Schneider Electric SEVD-2026-286-02 (SAGE RTU CVE-2026-102250, fixed in C3414-500-S02L0)

vulnerabilities ot ics