PowerChute is flagged a vulnerable to CVE-2026-49844
Issue:
PowerChute is flagged a vulnerable to CVE-2026-49844
Product:
PowerChute Serial Shutdown 1.6
PowerChute Network Shutdown 5.2
Environment:
All supported operating systems.
Cause:
PowerChute Serial Shutdown v1.6 ships with Log4j version 2.25.4
PowerChute Network Shutdown v5.2 ships with Log4j version 2.25.3
Solution:
For PowerChute Serial Shutdown 1.6 on Windows:
- Download the attached file PCSS1.6_log4j_update.zip file
- Uncompress the file PCSS1.6_log4j_update.zip
- Open a command prompt as an administrator
- Change directory to the PCSS1.6_log4j_update directory that was created when the zip file PCSS1.6_log4j_update.zip was uncompressed.
- Run the command run_patch.cmd
The patch will remove the current log4j files and replace them with log4j version 2.26.1.
For PowerChute Network Shutdown 5.2 on Windows:
- Download the attached file PCNS5.2_log4j_update.zip file
- Uncompress the file PCNS5.2_log4j_update.zip
- Open a command prompt as an administrator
- Change directory to the PCSS5.2_log4j_update directory that was created when the zip file PCSS5.2_log4j_update.zip was uncompressed.
- Run the command run_patch.cmd
The patch will remove the current log4j files and replace them with log4j version 2.26.1.
NOTE: Files to update the PCSS 1.6 and PCNS 5.2 log4j files on Linux OS will be added soon.
Released for: Schneider Electric India
