Session hijacking reads differently depending on what the session controls. Schneider's own product descriptions inside the advisory set the stakes: EPAS-GTW exists to remotely monitor and operate electrical processes [4], EPAS-UI is an HMI SCADA for electrical networks and substation operations [5], the MiCOM C264 is a modular substation or bay controller and smart RTU [7], and the MiCOM P30 and P40 families are protection and control relays for medium, high and extra high voltage networks [6]. CISA states the consequence as malicious actors performing unauthorized operations within the affected system [2]. On this equipment, an operation is a switching action or a protection setting.
The version table is where the actual work sits. In the text supplied, 34 version lines are listed before the list is cut off mid-entry [20][16]. Twenty-seven carry the CVE-2026-4827 tag and seven do not [20]. Of those seven, three are strings identical to the upper bound of a tagged range: P139.678.700, P439.678.700 and P539.678.700 all appear once inside a "less than or equal to" affected range and once on their own [21]. Two more sit one increment above a tagged ceiling, with C264 D7.34 listed against affected builds up to D7.33, and Easergy C5 1.1.18 against affected builds up to 1.1.17 [21][8][13]. That pattern is consistent with fixed builds being carried in the same table, but nothing in the excerpt labels them that way [15]. Saitel DP up to 11.06.36 and EasyLogic T150 up to 11.06.30 also appear with no CVE against them [12].
The numbering schemes do not line up across the estate. D7.33 for the C264 [8], 02.502.103 for the PowerLogic P5, 2.9.4 for the T300, 11.08.02 for the T500 [11], 6.4.616.200.100 for the gateway and 3.0.3 for the user interface [9] are six different conventions, so matching an installed base against this advisory means recording model plus exact firmware string per device before any patch decision is possible.
On exploitability, the material is thin and should be read that way. The supplied advisory carries no CVSS score, no attack vector and no statement about known exploitation [17]. That leaves reachability as the variable operators actually hold: which hosts can open a session to an EPAS gateway or an EPAS-UI console, and from which network. The relays and bay controllers behind those sessions are the reason the question is worth answering [6][7].
What Update A adds is scope [1], and scope decides the unit of work: the substation estate rather than any one product line.
