CVE-2026-84860
HighCVSS 8.8Summary
ScadaLTS 2.8.1-release-candidate build 0 suffers from an authorization bypass in DWR endpoints. Spring Security gates by URL pattern, but DWR dispatches based on POST body parameters, allowing any authenticated user to invoke any DWR method.
Risk Assessment
Low-privileged users may exploit this to call administrative functions, potentially leading to system compromise.
Recommendation
Apply a patch or upgrade to a fixed version. Temporarily restrict access to DWR endpoints or enable origin validation.
Other vulnerabilities in ScadaLTS
See all- CVE-2026-84859Medium
An authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0 in the /api/events/search endpoint. The sortBy array values are concatenated directly into the SQL ORDER BY clause without sanitization, allowing authenticated users with ROLE_USER to perform time-based and boolean-based blind SQL injection to extract arbitrary data, including password hashes of all users.
- CVE-2026-84858High
ScadaLTS 2.8.1-release-candidate build 0 has a remote code execution (RCE) vulnerability via scripting sandbox bypass. The validateScript method in DataSourceEditDwr compiles and executes attacker-supplied JavaScript without authorization, which can be exploited by a low-privileged user.
- CVE-2026-19656Critical
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
- CVE-2026-19657Medium
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
Original NVD description (English source)
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body. This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.