Schneider Electric's security notification SEVD-2026-251-04 (8 September 2026) describes CVE-2026-3869, an incorrect implementation of an authentication algorithm (CWE-303) in Modicon M580 and Modicon M580 Safety controllers.

Schneider says failure to apply the remediations may risk establishing an unauthenticated connection to the controllers, which could result in loss of confidentiality, integrity and availability of the PLC, when an application project with a lower application level is running on it. Schneider rates it Critical: CVSS v4.0 9.2 and CVSS v3.1 9.8. Affected: Modicon M580 with an application level below 4.00 and Modicon M580 Safety with an application level below 4.20.

Remediation: for M580, firmware 4.10 or above and an application project at application level 4.00 or above (available in EcoStruxure Control Expert V15.2 or later); for M580 Safety, firmware 4.21 or above and application level 4.20 or above (EcoStruxure Control Expert V16.0 with HF001 or later). (source: Schneider Electric SEVD-2026-251-04)

Schneider's security notifications index lists other advisories published the same day, for EcoStruxure IT Data Center Expert (CVE-2026-19233, CVE-2026-8044), PowerLogic T300 RTU (CVE-2026-77120) and SCADAPack x70 products (CVE-2026-81861), and shows older Modicon advisories last updated that day. (source: Schneider Electric security notifications)

Correction (29 Oct 2026): this card previously combined Schneider Electric, Siemens, AVEVA and Rockwell September ICS advisories from a news report; Siemens now has its own card, the AVEVA and Rockwell mentions were removed because no readable source for them is linked, and this card is now sourced from Schneider's own notifications. The card date is now 8 September 2026, the date on Schneider's notification (it was 9 September). (source: Schneider Electric SEVD-2026-251-04)