CVE-2026-8024: Deserialization vulnerability in ibaPDA and ibaDatCoordinator

Synopsis

A deserialization of untrusted data vulnerability affects ibaPDA (versions 1.0.0 through below 8.14.0) and ibaDatCoordinator (versions 1.0.0 through below 4.0.7). The flaw is reachable over the network with no authentication required, meaning any attacker with network access to the service can send maliciously crafted serialized data. Successful exploitation gives the attacker full control of the affected system, including the ability to read, modify, or destroy data and execute arbitrary commands. Patched-image rebuilds at versions 8.14.0 and 4.0.7 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ibaPDA or ibaDatCoordinator service over the network; no local or physical access is needed, but the service must be exposed to the attacker's network.

• AuthenticationNot required

  No account or credentials are needed; the vulnerable deserialization endpoint accepts input from unauthenticated connections.

• Victim interactionNot required

  The attacker sends a crafted payload directly to the service and no user action or interaction is required to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layout, or environmental prerequisites are required beyond reaching the service.

Blast Radius

• A successful attacker achieves full read access to the host, including stored process data, configuration files, credentials, and any secrets held by ibaPDA or ibaDatCoordinator.
• The attacker can modify or delete persisted data records, measurement archives, and system configuration, corrupting industrial process history.
• The attacker can execute arbitrary code or commands on the affected host with the privileges of the running service process.
• All three impacts (confidentiality, integrity, availability) are rated High under CVSS v4.0, so the attacker retains the ability to crash or halt the affected service entirely.