Home / Items
Vendor advisorySeverity 8.8 high
Use of Unmaintained Third-Party Components vulnerability on Pro-face STW6000 and Harmony STW6
SEVD-2026-286-01 · Schneider Electric · October 13, 2026
Summary
Schneider Electric is aware of multiple vulnerabilities in its Pro-face STW6000 and Harmony STW6 products. The Pro-face STW6000 and Harmony STW6 products are Basic Web HMI panels belongs to the Schneider Electric Harmony ST6 and Pro-face ST6000 range and is designed to meet the needs of simple machine operators for good visualization, connectivity, and cost-effective equipment. Failure to apply the mitigations provided below may risk various attack scenarios due to Third-party component obsolescence, which could result in unauthorized control to the device and operational failures.
From Schneider Electric (vendor's own words, quoted), quoted as published. Check the source before acting.
What to do
Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Use HMI only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks.
• Configure the trusted local websites for connecting and browsing in the HMI device.
• Setup network segmentation and implement a firewall to block all unauthorized access.
• Restrict usage of unverifiable portable media
• Configuration must be done by a trusted administrator and authenticated users
To ensure you are informed of all…
Vendor fix or mitigation, quoted from the advisory.
Each CVE in this advisory
| CVE | Severity | Known exploited | Exploit likelihood |
|---|---|---|---|
| CVE-2026-96434 | 8.8 high | No | — |
Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).
Affected products
| Vendor | Product |
|---|---|
| Schneider Electric | Pro-face STW6000 |
| Schneider Electric | Harmony STW6 |
Why it's on these mode pages
- Pipeline: Vendor table: Schneider Electric (matched by rule)
Change history
- October 13, 2026: Original Release
- November 9, 2026: First collected by Watch
Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com