CVE-2026-1762: GE Vernova Enervista Path Traversal Flaw

CVE-2026-1762 Overview

A vulnerability has been identified in GE Vernova Enervista UR Setup on Windows that allows file manipulation. This security flaw affects Enervista version 8.6 and all prior versions. The vulnerability is classified as CWE-23 (Relative Path Traversal), which enables attackers with physical access and high privileges to manipulate files on the affected system.

Critical Impact

An attacker with physical access to a Windows system running vulnerable versions of GE Vernova Enervista UR Setup can perform file manipulation, potentially compromising system integrity and availability of the industrial control software.

Affected Products

• GE Vernova Enervista UR Setup version 8.6
• GE Vernova Enervista UR Setup versions prior to 8.6
• Windows systems running vulnerable Enervista installations

Discovery Timeline

• 2026-02-10 - CVE CVE-2026-1762 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-1762

Vulnerability Analysis

This vulnerability affects the GE Vernova Enervista UR Setup software, which is commonly used for configuring and managing protective relays in industrial and utility environments. The flaw stems from improper handling of file paths within the application, allowing relative path traversal attacks (CWE-23).

The vulnerability requires physical access to the target system and high-level privileges to exploit, which significantly limits the attack surface. However, in industrial control system (ICS) environments where Enervista is typically deployed, insider threats or compromised operator workstations could leverage this vulnerability to manipulate critical configuration files.

Root Cause

The root cause of this vulnerability lies in insufficient validation of file path inputs within the Enervista UR Setup application. The software fails to properly sanitize relative path sequences (such as ../ patterns) when processing file operations. This allows an authenticated, high-privileged user with physical access to traverse outside of intended directories and manipulate files on the system.

CWE-23 (Relative Path Traversal) occurs when software uses external input to construct a pathname that should be within a restricted directory, but fails to properly neutralize sequences that can resolve to a location outside of that directory.

Attack Vector

The attack requires physical access to the target Windows workstation running the vulnerable Enervista UR Setup software. An attacker must possess high-level privileges on the system to exploit this vulnerability. Once these prerequisites are met, the attacker can craft malicious file path inputs containing relative traversal sequences to access or modify files outside the application's intended working directory.

Given the industrial control system context, successful exploitation could allow manipulation of relay configuration files, log files, or other sensitive data managed by the Enervista software. This could impact the integrity and availability of protective relay configurations in power grid and utility infrastructure.

Detection Methods for CVE-2026-1762

Indicators of Compromise

• Unexpected file modifications in directories outside the Enervista application folder
• Anomalous file access patterns originating from the Enervista UR Setup process
• Log entries showing file operations with relative path traversal patterns (../, ..\\)

Detection Strategies

• Monitor file system activity from the Enervista UR Setup application for path traversal sequences
• Implement file integrity monitoring (FIM) on critical configuration directories
• Review Windows Security logs for unusual file access by high-privileged users on Enervista workstations

Monitoring Recommendations

• Enable detailed Windows audit logging for file system access on systems running Enervista
• Deploy endpoint detection and response (EDR) solutions to monitor process file operations
• Establish baselines for normal Enervista file access patterns and alert on deviations

How to Mitigate CVE-2026-1762

Immediate Actions Required

• Identify all systems running GE Vernova Enervista UR Setup version 8.6 or earlier
• Restrict physical access to workstations running Enervista to authorized personnel only
• Review and minimize high-privilege account access on affected systems
• Implement additional monitoring on Enervista workstations until patches are applied

Patch Information

Organizations should consult the GE Vernova Grid Solutions Resources page for official security advisories and patch information. Contact GE Vernova support for guidance on obtaining and applying security updates for Enervista UR Setup.

Workarounds

• Implement strict physical access controls to limit who can access Enervista workstations
• Apply principle of least privilege to reduce the number of high-privileged accounts
• Use application whitelisting to control which processes can perform file operations
• Isolate Enervista workstations on dedicated network segments with restricted access

# Configuration example - Windows file system auditing for Enervista directory
# Enable auditing via Group Policy or auditpol
auditpol /set /subcategory:"File System" /success:enable /failure:enable

# Monitor for path traversal patterns in file access logs
# Review Security Event ID 4663 for file access attempts