CVE-2026-22619 is a high severity insecure library loading flaw (CVSS 7.8) in Eaton Intelligent Power Protector (IPP). An attacker with access to the software package could run arbitrary code. Eaton says the latest IPP version fixes it, so update from the Eaton download center.
What's affected
Eaton Intelligent Power Protector. The record does not give a version range. It says the issue is fixed in the latest version of the software on the Eaton download center.
The reference is Eaton security bulletin ETN-VA-2025-1025. Use it for the exact affected and fixed versions.
How to check if you're exposed
Open the IPP application to read its installed version, and compare it with the version in Eaton bulletin ETN-VA-2025-1025 and on the Eaton download center.
Also check where IPP is installed and who can write to that folder, because the flaw depends on an attacker being able to influence what the executable loads.
What to do now
- Download the latest IPP release from the Eaton download center.
- Read bulletin ETN-VA-2025-1025 for the affected and fixed versions.
- Install the update on every machine that runs IPP, including virtual machines used for shutdown control.
- Make sure the install directory is writable only by administrators.
- Keep a list of hosts that run IPP so future bulletins are quick to act on.
Why it matters
The weakness is CWE-427, an uncontrolled search path element. A program that loads a library from a place an attacker can write to may run the attacker's code instead. The vector shows local access, low privileges and high attack complexity, so this is a local step, not a remote one.
The scope is changed and impact is high, because the record rates confidentiality, integrity and availability impact as high. The record does not say it is exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is this remotely exploitable?
No. The vector is local, with low privileges required and high attack complexity.
Where is the fix?
In the latest IPP version on the Eaton download center, per the record. Eaton bulletin ETN-VA-2025-1025 has the details.
Sources
Last reviewed: 19 October 2026.
