CVE-2026-9645: ScadaBR Authenticated Remote Code Execution

Synopsis

An authenticated remote code execution vulnerability affects ScadaBR 1.2.0, an open-source SCADA (supervisory control and data acquisition) web application. The vulnerability is reachable over the network and requires only a low-privilege account; no additional user interaction is needed. Successful exploitation gives an attacker full control of the underlying host, because injected JavaScript executes server-side as the root user, enabling complete system compromise including data theft, tampering, and service disruption. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ScadaBR web application over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A valid account is required, but any low-privilege user account is sufficient to trigger the vulnerable methods.

• Victim interactionNot required

  No victim interaction is needed; the attacker exercises the exploit entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental dependencies.

Blast Radius

• The attacker gains the ability to execute arbitrary operating system commands as root, achieving full control of the host running ScadaBR.
• All data stored or accessible by the server is readable, including process historian records, user credentials, and any secrets in the environment.
• The attacker can modify or delete persisted configuration, setpoint data, and operational records, corrupting the integrity of the SCADA environment.
• The attacker can terminate processes, delete system files, or otherwise crash the host, causing a complete loss of availability for the controlled industrial systems.