CVE-2026-6866 is a CWE-1188 vulnerability affecting Schneider Electric EcoStruxure™ Panel Server (versions 002.005.000 and earlier). It arises from initializing a resource with insecure default credentials that, under rare conditions, revert to initial settings. This can enable unauthorized authentication using these known default credentials, potentially exposing sensitive information. The vulnerability has a high CVSS 4.0 score of 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

The vulnerability can lead to unauthorized disclosure of sensitive information by allowing attackers to authenticate using default credentials if the system reverts to insecure initial settings. This compromises confidentiality but does not indicate impact on integrity or availability. The high CVSS score reflects the ease of exploitation and significant confidentiality impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor Schneider Electric's advisories for updates. Until a fix is available, restricting network access to the affected Panel Server and using compensating controls to limit exposure to unauthorized users may reduce risk.