PowerChute is flagged a vulnerable to CVE-2026-49844

Question

Accepted Answer

Issue:

PowerChute is flagged a vulnerable to CVE-2026-49844

Product:

PowerChute Serial Shutdown 1.5, 1.6

PowerChute Network Shutdown 5.2

Environment:

All supported operating systems.

Cause:

PowerChute Serial Shutdown 1.5 and 1.6 ship with Log4j versions less than version 2.25.5

PowerChute Network Shutdown 5.2 ships with Log4j versions less than version 2.25.5

Solution:

For PowerChute Serial Shutdown 1.5, 1.6 on Windows:

Download the attached file PCSS_Log4j_Update.zip file
Uncompress the file PCSS_Log4j_Update.zip
Open a command prompt as an administrator
Change directory to the PCSS_Log4j_Update.zip directory that was created when the zip file PCSS_Log4j_Update.zip was uncompressed.
Run the command run_patch.cmd

The patch will remove the current log4j files and replace them with log4j version 2.26.1.

For PowerChute Network Shutdown 5.2 on Windows:

Download the attached file PCNS5.2_log4j_update.zip file
Uncompress the file PCNS5.2_log4j_update.zip
Open a command prompt as an administrator
Change directory to the PCSS5.2_log4j_update directory that was created when the zip file PCSS5.2_log4j_update.zip was uncompressed.
Run the command run_patch.cmd

The patch will remove the current log4j files and replace them with log4j version 2.26.1.

For PowerChute Network Shutdown version 5.2 on Linux

Download the attached log4j-2.26.1.tar file, and if needed, copy the file to the Linux system.
Uncompress the log4j-2.26.1.tar file. The command is tar -xvf log4j-2.26.1.tar.
Stop the PowerChute service. The command is systemctl stop PowerChute
Change directory to the PowerChute lib directory. The default path is /opt/APC/PowerChute/group1/lib
Move the log4j2 files to the APC directory. If PowerChute resides in the default path, the command is mv /opt/APC/PowerChute/group1/lib/log4j2* /opt/APC
Change directory to the log4j-2.26.1 directory that was created when you uncompressed the tar file.
Copy the log4j-api-2.26.1jar, log4j-core-2.26.1.jar, log4j-slf4j-impl-2.26.1.jar to the PowerChute lib directory that resides where PowerChute resides. If PowerChute resides in the default path, the command is cp log4j2* /opt/APC/PowerChute/group1/lib
Start the PowerChute service. The command is systemctl start PowerChute

For PowerChute Serial Shutdown versions 1.5 and 1.6 on Linux

Download the attached log4j-2.26.1.tar file, and if needed, copy the file to the Linux system.
Uncompress the file. The command is tar -xvf log4j-2.26.1.tar.
Stop the PowerChute service. The command is systemctl stop PBEAgent
Change directory to where PowerChute has been installed. The default path is /opt/APC/PowerChuteSerialShutdown/Agent/
Move the current log4j files. If PowerChute was installed to the default path, the command is mv /opt/APC/PowerChuteSerialShutdown/Agent/lib/log4j* /opt/APC
Change directory to the log4j-2.26.1 directory that was created when log4-2.26.1.tar was uncompressed.
Copy the new logj4 files to the PowerChute lib directory. If PowerChute was installed to the default path, the command is cp log4j.* /opt/APC/PowerChuteSerialShutdown/Agent/lib
Restart the PowerChute service. The command is systemctl start PBEAgent

Released for: Schneider Electric Vietnam