CVE-2026-84858
8.8 HIGHPublished 2026-09-16 · Updated 2026-09-18
AI risk analysis
- Summary
- The flaw allows an attacker with low privileges to execute arbitrary code via the Scripting Sandbox Bypass in ScadaLTS 2.8.1-release-candidate build 0, due to lack of authorization checks.
- Exploitability
- Exploitation is relatively straightforward given the lack of authorization checks, requiring an authenticated low-privilege user to leverage the DWR routing bypass.
- Blast radius
- If exploited, the impact could be severe, potentially leading to full system compromise and control of the SCADA system.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to ScadaLTS 2.8.1-release-candidate build 1 or later, which addresses this vulnerability.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
References
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.