CVE-2026-3869 – Schneider Electric Modicon M580

Schneider Electric has fixed a critical authentication flaw in the Modicon M580 programmable logic controller. CVE-2026-3869 has a CVSS score of 9.2, Critical severity. The controller implements its authentication algorithm incorrectly (CWE-303), so an attacker can get past the checks that are supposed to protect it.

The flaw is exploitable when an application project with a lower application level is running on the PLC. Exploitation can cause full loss of confidentiality, integrity and availability on the controller. That exposes the physical processes it runs to tampering and shutdown. Industrial operators should treat this as a same-day priority.