CVE-2026-19656
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
Risk Assessment
The risk for the organization is full system compromise, as an attacker can gain complete control over the server and industrial data.
Recommendation
It is recommended to immediately apply patches provided by the ScadaLTS vendor and restrict system access to trusted users only. Also monitor logs for unusual commands.
Other vulnerabilities in ScadaLTS
See all- CVE-2026-84860High
ScadaLTS 2.8.1-release-candidate build 0 suffers from an authorization bypass in DWR endpoints. Spring Security gates by URL pattern, but DWR dispatches based on POST body parameters, allowing any authenticated user to invoke any DWR method.
- CVE-2026-84859Medium
An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.
- CVE-2026-84858High
ScadaLTS 2.8.1-release-candidate build 0 has a remote code execution (RCE) vulnerability via scripting sandbox bypass. The validateScript method in DataSourceEditDwr compiles and executes attacker-supplied JavaScript without authorization, which can be exploited by a low-privileged user.
- CVE-2026-19657Medium
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
Original NVD description (English source)
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS