CVE-2026-22619: Eaton IPP Insecure Library Loading Leading to Code Execution
CVE-2026-22619 affects Eaton Intelligent Power Protector (IPP) and is classified as CWE-427, an uncontrolled search path element that enables insecure library loading in the executable. The record states that an attacker with access to the software package could achieve arbitrary code execution, and that the issue is fixed in the latest version of Eaton IPP software. No confirmed exploitation appears in the sources consulted.
Overview
Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable. The weakness is mapped to CWE-427 (Uncontrolled Search Path Element), which means the software may load libraries from locations that are not adequately controlled. The vendor states the issue is fixed in the latest Eaton IPP software, available from the Eaton download center. The vendor's security bulletin is the primary reference listed in the record.
Impact
- The record states that an attacker with access to the software package could lead to arbitrary code execution.
- NVD lists a CVSS score of 9.9 with a scope-changed vector emphasizing high confidentiality, integrity and availability impact, while the CNA and Eaton list 7.8.
- The SSVC data in the record marks technical impact as total and automatable as no.
Affected products and versions
- Eaton Intelligent Power Protector: the record lists versions before 2.00.
- Eaton IPP software: the record lists versions before 2.0.
- The record does not explain whether these two entries describe the same release line. Administrators should verify the installed version against the vendor bulletin.
Exploitation status
The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is none. This assessment does not rule out future exploitation.
Remediation and mitigation
- Update Eaton IPP to the latest version available on the Eaton download center, as stated by the vendor.
- Confirm the fixed version in the vendor bulletin, because the record does not name a specific fixed version.
- Restrict who can access installation packages and the software directory, reducing the chance of tampered files in library search locations.
- Follow the vendor guidance for any additional hardening steps.
Detection guidance
- Review inventories for Eaton IPP installations and compare versions against the vendor bulletin.
- Monitor for unexpected library files placed in application directories or software package locations.
- Audit file integrity and changes to the installation tree, and alert on changes outside maintenance windows.
Limitations of the available information
- The record does not specify the vulnerable library names, the exact search paths, or the affected platforms.
- No fixed version number is provided in the record, and the fixes field is empty.
- The two affected entries use different version boundaries and product names, which requires confirmation from the vendor.
- The EPSS value is low, but the record gives no further exploitation telemetry.
Frequently asked questions
What is CVE-2026-22619?
It is a vulnerability in Eaton Intelligent Power Protector (IPP) involving insecure library loading in its executable, classified as CWE-427. The record says it could lead to arbitrary code execution by an attacker with access to the software package.
Is the vulnerability fixed?
The vendor states the issue is fixed in the latest version of Eaton IPP software, available on the Eaton download center. The record does not give a specific fixed version number, so the vendor bulletin should be checked.
Is this CVE known to be exploited in the wild?
The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value is none.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.