Powerchute Serial Shutdown 1.5 - Apache Log4j vulnerabilities CVE-2026-34478 & CVE-2026-34480

[MSJP]

The version of log4j-core-2.25.3.jar used in Powerchute Serial Shutdown 1.5 has the two vulnerabilities listed in the title, CVE-2026-34478 & CVE-2026-34480.

The are both HIGH vulnerabilities (CVSS 7.5) but despite being published a month ago, there is no update for Powerchute Serial Shutdown or even an acknowledgement of the issue on Schneider's security page - https://www.se.com/ww/en/work/support/cybersecurity/security-notifications/ 

When can we expect this to be addressed? Like most businesses running in the 21st century, we have to patch vulnerabilities within two weeks but this just isn't currently possible.

[MSJP]

Does anybody from Schneider contribute to this community? 

[BillP]

@MSJP 

Mitigation scripts for CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480 are available attached to Schneider Electric FAQ000281802

[MSJP]

Thanks for the update and pointer to a patch.

I don't wish to seem ungrateful but Schneider really need to do better with regards to responding to security issues in their products. Enterprises are expected to patch security issues within a couple of weeks - waiting two months for a software fix is just not satisfactory and becomes a criteria for future purchases.