eaton has 6 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was December 2025 with 3. The median CVSS is 7.5 (high). None have a confirmed exploitation report. Most affected products: ups_companion (3), easyE4 (2), easySoft (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- ups_companion 3
- easyE4 2
- easySoft 1
Worst active — by depth score
CVE-2025-59887High· 8.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package47CVE-2025-67450High· 7.8Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC wh…43CVE-2026-41021High· 7.5Eaton easyE4 uses an insufficiently strong password policy41CVE-2026-41020High· 7.5Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.41CVE-2025-59888Medium· 6.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system37
eaton vulnerabilities
CVEs affecting eaton, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-41022Medium· 5.9Eaton easySoft improperly validates TLS certificates presented by easyE4 devices
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between ea…
CVE-2026-41021High· 7.5Eaton easyE4 uses an insufficiently strong password policy
Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.
CVE-2026-41020High· 7.5Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.
CVE-2025-59887High· 8.6Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package
Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest versi…
CVE-2025-67450High· 7.8Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC wh…
Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC wh…
CVE-2025-59888Medium· 6.7Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the file system. This security issue has been fixed in the latest version of EUC…