CISA 2026-10-01

ABB Protection and Control IED Manager PCM600

Machine-generated analysis · WAYSCloud LLM

PCM600 versions up to 2.14 permit local users to elevate privileges via the Scheduler Service.

Context

The advisory concerns ABB Protection and Control IED Manager PCM600, versions 2.14 and earlier. It states that the Scheduler Service runs under the LocalSystem account while standard PCM600 users have permissions, allowing a local user with valid credentials to gain higher privileges. The advisory notes that a workaround exists by configuring the service to run under the same Windows account as the PCM600 application, though this does not remediate the underlying flaw.

Operator considerations

Check: verify PCM600 version and service account configuration.
Isolate: limit network access to hosts running PCM600.
Log: monitor changes to the ABBPCMSchedulerService logon account and privilege escalation events.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files.

The following versions of ABB Protection and Control IED Manager PCM600 are affected:

Protection and Control IED Manager PCM600

Read the full advisory on CISA →