CVE-2026-15952
mediumpriority · track · 0EPSS 0.001 · 1 %ileCHUSEPSS · scored 2026-10-27
Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationProtection and Control IED Manager PCM600cisa_csaf_ot
ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation.
- WorkaroundProtection and Control IED Manager PCM600abb_psirt
ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation. Configure the appropriate ABBPCMSchedulerService instance to run using the same Windows account that is used to operate PCM600. - Open Services.msc. - Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version. - Open Properties and select the Log On tab. - The service should be configured to log on with the same Windows user account that is used for the PCM600 application. - Ensure that this account has the required "Log on as a service" privilege. When authentication is enabled for the IED, the Scheduler tool must be used with the same Windows account configured as the Scheduler Service logon account. For installations using IED security certificates, the PCM600 setting Always trust IED security certificates must be enabled only when PCM600-to-IED communication takes place in a secure and trusted environment. Impact of Workaround -Scheduler functionality will operate using the privileges of the configured Windows user account rather than SYSTEM privileges. - Users may need to be granted the "Log on as a service" Windows user right. - In environments using IED security certificates, enabling Always trust IED security certificates may reduce certificate validation protections and should only be used in secure and trusted environments. - Administrative effort may be required to maintain consistent user accounts between PCM600 and the Scheduler Service.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4–7.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- 2NGA003170ABB Protection and Control IED Manager PCM600 Scheduler Service Privilege Escalation Vulnerability2026-09-28csaf · abb_psirtCH
ABB is aware of a reported vulnerability in ABB Protection and Control IED Manager (PCM600). A local authenticated user belonging to the PCM600 user group may be able to modify the configuration of a Windows service running with SYSTEM privileges. Successful exploitation could allow an attacker to execute arbitrary commands with elevated privileges on the affected workstation. Note: This document references the ABBPCMSchedulerService_v214 component as implemented in PCM600 version 2.14. However, the described issue is not version-specific and applies equally to the corresponding component in other supported versions of PCM600.
- ICSA-26-274-03ABB Protection and Control IED Manager PCM6002026-10-01icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan