Two weaknesses, different paths
CISA’s October 1 advisory identifies two vulnerabilities in ABB Protection and Control IED Manager PCM600 through version 2.14. CVE-2026-15952 concerns a Scheduler Service configuration that may let someone with local access and valid credentials elevate privileges on the host. CVE-2026-15953 concerns insufficient validation of project-archive paths, which can permit files to be written outside the intended extraction directory. CISA associates the product with the energy sector and says it had received no reports of known public exploitation specifically targeting these vulnerabilities at publication.
A workaround has a defined scope
The advisory describes changing the relevant Scheduler Service to use the same Windows account used for PCM600, with the required service-logon permission. It explicitly says the workaround reduces privilege-escalation risk without correcting the underlying vulnerability. Operators should consult ABB’s linked advisories for the current treatment of each issue. A service-account change should not be assumed to resolve the separate project-archive weakness. Nor does this advisory establish that a utility’s protection equipment has been compromised.
The workstation belongs in the operational inventory
Our assessment: energy operators should connect the software inventory to the engineering workflow. Identify who maintains each installation, which projects it handles and whether contractors or internal engineers share responsibility for the host. The value of that inventory is practical: it allows the operator to assign the change to someone who understands the dependent work. Manufacturing facilities using the affected software should perform the same applicability check rather than assuming that sector labels determine exposure. Keep the vendor’s affected-product scope separate from a broad review of other industrial tools.
Validate the change before closing the ticket
Plan changes with the operational owner and test the actual scheduled work afterward. Capture the original service configuration, the approved replacement account and the rollback procedure without storing account secrets in the ticket. Separately, review how project files arrive, who is allowed to import them and how unexpected files are investigated. Those checks are editorial recommendations for controlling the workflow, not evidence of attacks at a particular site. The completion record should distinguish a configured workaround from a confirmed software correction and identify any remaining exception. For an MSP, the strongest handover is one that shows the security action and the operational validation together, so neither team assumes the other has resolved the outstanding risk.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
