Executive Summary
ABB's Protection and Control IED Manager PCM600 version 2.14 and earlier contains two critical vulnerabilities (CVE-2026-15952 and CVE-2026-15953) that enable privilege escalation and path traversal attacks. CVE-2026-15952 allows attackers with local access to exploit the Scheduler Service running under LocalSystem to gain elevated privileges, while CVE-2026-15953 permits malicious project archive files to write content outside intended directories through insufficient path validation. These vulnerabilities impact energy sector critical infrastructure worldwide, potentially allowing attackers to gain system control or deploy malicious files in sensitive industrial control environments.
These vulnerabilities highlight the growing threat to operational technology (OT) environments as attackers increasingly target industrial control systems. With energy infrastructure becoming a prime target for nation-state actors and ransomware groups, securing ICS/SCADA systems against privilege escalation and file manipulation attacks has become critical for maintaining grid stability and preventing operational disruptions.
Why This Matters Now
Industrial control system vulnerabilities are increasingly exploited by ransomware groups and nation-state actors targeting critical infrastructure, making OT security a national security priority requiring immediate attention and remediation.
Attack Path Analysis
Attacker gains local access to ABB PCM600 system through legitimate user credentials, then exploits privilege escalation vulnerabilities in the Scheduler Service (CVE-2026-15952) to gain LocalSystem privileges. Using elevated access, attacker exploits path traversal vulnerability (CVE-2026-15953) to write malicious files outside intended directories and establish persistence. From compromised industrial control system, attacker moves laterally through the operational technology network to access critical energy infrastructure components. Command and control is established through legitimate system management channels, masquerading as normal PCM600 operations. Sensitive industrial control configurations, operational data, and potentially critical infrastructure information is exfiltrated. Final impact includes disruption of energy grid operations and compromise of critical infrastructure protection systems.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker obtains local access to ABB PCM600 system using valid user credentials through credential stuffing, phishing, or insider access
Related CVEs
CVE-2026-15952
CVSS 6.4A privilege escalation vulnerability in ABB PCM600 Scheduler Service allows local attackers with valid credentials to elevate privileges to LocalSystem account.
Affected Products:
ABB Protection and Control IED Manager PCM600 – <= 2.14
Exploit Status:
no public exploitCVE-2026-15953
CVSS 5A path traversal vulnerability in ABB PCM600 project archive processing allows files to be written outside the intended extraction directory.
Affected Products:
ABB Protection and Control IED Manager PCM600 – <= 2.14
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploitation for Privilege Escalation
System Services: Service Execution
Access Token Manipulation
Process Injection
Boot or Logon Autostart Execution: Shortcut Modification
Exploitation for Client Execution
Abuse Elevation Control Mechanism: Bypass User Access Control
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST Cybersecurity Framework 2.0 – Physical and logical access to assets is managed based on the principle of least privilege
Control ID: PR.AA-06
CISA Zero Trust Maturity Model 2.0 – Application Security
Control ID: 1.3
NIS2 Directive – Cybersecurity measures
Control ID: Article 21
DORA – Identification
Control ID: Article 8
ISO 27001:2022 – Privileged access rights
Control ID: A.8.2
NYDFS 23 NYCRR 500 – Cybersecurity program
Control ID: 500.02(b)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
ABB PCM600 privilege escalation vulnerabilities directly impact electrical grid protection systems, enabling attackers to compromise critical infrastructure through path traversal and scheduler service exploitation.
Oil/Energy/Solar/Greentech
Energy sector IED management systems face elevated risk from privilege escalation attacks targeting ABB protection control systems used in power generation and distribution facilities worldwide.
Electrical/Electronic Manufacturing
Manufacturing facilities using ABB protection equipment vulnerable to file overwrite attacks and privilege escalation through PCM600 scheduler service and project archive processing weaknesses.
Industrial Automation
Industrial control environments exposed to privilege escalation risks through compromised ABB IED management systems, potentially enabling lateral movement across automated production control networks.
Sources
- ABB Protection and Control IED Manager PCM600https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-03Verified
- ABB Security Advisory 2NGA003170https://www.abb.com/security-advisoriesVerified
- ABB Security Advisory 2NGA003179https://www.abb.com/security-advisoriesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF segmentation would likely reduce the blast radius of this industrial control system compromise by constraining lateral movement between OT network segments and limiting attacker reach across critical infrastructure components.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial system access would likely remain possible, but subsequent attacker movements and privilege expansion could be constrained through identity-aware access controls and workload isolation boundaries within the industrial network environment.
Control: Zero Trust Segmentation
Mitigation: Local privilege escalation may still occur on the compromised PCM600 system, but the blast radius of elevated privileges would likely be constrained to isolated workload segments rather than providing broad network access.
Control: East-West Traffic Security
Mitigation: Lateral movement between industrial control system segments would likely be significantly constrained, limiting attacker reach to connected IED devices and reducing the scope of network traversal across operational technology infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Command and control communications may still utilize legitimate protocols, but the reachability and scope of these channels would likely be reduced through enhanced network visibility and controlled communication pathways.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration pathways would likely be constrained through controlled egress policies, limiting the volume and scope of sensitive industrial configuration data that could be extracted from the compromised environment.
While some operational disruption may still occur within compromised segments, the overall impact to energy grid operations would likely be reduced through constrained attacker reach and limited access to critical infrastructure protection systems.
Impact at a Glance
Affected Business Functions
- Power Grid Protection Systems
- Industrial Equipment Monitoring
- Energy Distribution Control
- Critical Infrastructure Management
Estimated downtime: 3 days
Estimated loss: N/A
Potential exposure of industrial control system configurations, protection relay settings, and critical infrastructure operational parameters through privilege escalation and file system access
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate industrial control systems and prevent lateral movement from compromised PCM600 instances to critical energy infrastructure components
- • Deploy East-West Traffic Security controls to monitor and restrict workload-to-workload communication between PCM600 systems and connected IED devices
- • Enable Multicloud Visibility & Control to detect anomalous interactions and suspicious automation patterns in industrial control network traffic
- • Establish Egress Security & Policy Enforcement to prevent unauthorized exfiltration of critical infrastructure configurations and operational data
- • Deploy Encrypted Traffic (HPE) capabilities to protect sensitive industrial control data in transit between PCM600 systems and energy grid components
