PowerChute bugs allow file overwrite and denial of service

The ICS Advisory for Schneider Electric PowerChute Serial Shutdown, released on July 9, 2026, identifies multiple vulnerabilities in the product versions up to 1.4. Exploiting these vulnerabilities can lead to serious issues, including file overwrites, unauthorized access, denial-of-service conditions, and exposure of sensitive information. The advisory highlights specific vulnerabilities like improper path limitations, insufficient output encoding, and excessive authentication attempts.

Users are advised to upgrade to version 1.5 to mitigate these risks. The advisory also stresses implementing cybersecurity best practices, such as minimizing network exposure for control system devices and utilizing secure access methods.