ABB Protection and control IED manager PCM600 — vulnerability CVE-2026-15952

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

ABB recommends the following workaround. Although this workaround does not correct the underlying vulnerability, it reduces the risk of privilege escalation. Configure the appropriate ABBPCMSchedulerService instance to run using the same Windows account that is used to operate PCM600. - Open Services.msc. - Locate the ABBPCMSchedulerService corresponding to the installed PCM600 version. - Open Properties and select the Log On tab. - The service should be configured to log on with the same Windows user account that is used for the PCM600 application. - Ensure that this account has the required "Log on as a service" privilege. When authentication is enabled for the IED, the Scheduler tool must be used with the same Windows account configured as the Scheduler Service logon account. For installations using IED security certificates, the PCM600 setting Always trust IED security certificates must be enabled only when PCM600-to-IED communication takes place in a secure and trusted environment. Impact of Workaround -Scheduler functionality will operate using the privileges of the configured Windows user account rather than SYSTEM privileges. - Users may need to be granted the "Log on as a service" Windows user right. - In environments using IED security certificates, enabling Always trust IED security certificates may reduce certificate validation protections and should only be used in secure and trusted environments. - Administrative effort may be required to maintain consistent user accounts between PCM600 and the Scheduler Service.