ABB PCM600 Scheduler Service Requires Privilege-Escalation Workaround
Tech GuruQuick Answer
ABB's PCM600 Scheduler advisory describes a local privilege-escalation path through service-control permissions and a service running as LocalSystem. It names a workaround, not a fixed release. The versioned Scheduler service name is an example; the issue also applies to the corresponding component in other affected PCM600 versions.
Apply The Documented Scheduler Workaround
What to do now: have the engineering-workstation owner review the matching Scheduler service and ABB's account-change procedure. Preserve its current configuration and job requirements. Do not substitute an unspecified upgrade or the separate project-import hotfix for this workaround.
Last verified: October 2, 2026 UTC against ABB CSAF revision 1. No Windows service or IED operation was performed.
Scope And Authority
| Product scope | ABB Protection and Control IED Manager PCM600 through version 2.14 |
|---|---|
| Advisory | 2NGA003170 |
| CVE | CVE-2026-15952 |
| Authoritative release date | 2026-09-28 00:30:00 UTC (ABB CSAF initial release); added to the ABB CSAF feed at 2026-09-28 12:00:00 UTC |
| Authority revision date | 2026-09-28 00:30:00.000 UTC |
| Affected versions | Supported ABB PCM600 versions through 2.14 with the Scheduler Service configured to run as LocalSystem while granting service-control permissions to PCM600 users. |
| Fixed version | No fixed release stated; configure the applicable ABBPCMSchedulerService to run as the same Windows account used for PCM600, following ABB's documented workaround |
| CVSS base score | 6.4 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | ABB reported no information indicating exploitation when this advisory was initially issued; this is not a guarantee of no subsequent exploitation. |
What Changed
The permission defect lets a locally authenticated user with the relevant service-control access alter a service that runs with elevated privileges. ABB's workaround lowers the service's execution identity; it does not correct the underlying permission defect. Treat workstation compromise as a separate investigation, not something an account change can undo.
What To Validate Now
- Identify the instance. Open
Services.mscand locate theABBPCMSchedulerServicecorresponding to the installed PCM600 version. Record its current logon account and scheduled jobs. - Apply ABB's workaround. In Properties > Log On, configure the same Windows account used to operate PCM600. Ensure it has the Log on as a service user right. Do not put its password in a script, screenshot or change ticket.
- Keep identities aligned. Where IED authentication is enabled, use the Scheduler tool with the same account as the service. Validate an approved scheduled task and access to required resources in a controlled window.
- Retain the limitation. Save the before/after service identity and job result. If the workaround breaks required operation, involve ABB and the engineering owner; restoring LocalSystem restores the original exposure.
Operational Cautions
Certificate caution: ABB says Always trust IED security certificates reduces certificate-validation protection and must only be used in a secure, trusted PCM600-to-IED environment. Do not enable it as a routine login fix. Resolve trust and account requirements with the engineering owner before changing a working protection-system workflow.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
