CVE-2026-19656

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.tenable.com/security/research/tra-2026-55	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:scada-lts:scada-lts:2.7.8.1:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) ScadaLTS 2.7.8.1 expone un método del lado del servidor que carece de comprobaciones de autorización, permitiendo a cualquier usuario autenticado (incluido uno que solo tenga permisos de bajo privilegio y de solo lectura) ejecutar comyos arbitrarios del sistema operativo en el host. La explotación exitosa resulta en la ejecución de código en el contexto del proceso del servidor ScadaLTS (root), lo que lleva a un compromiso total del sistema suporacente.

Information

Published : 2026-08-12 20:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-19656

Mitre link : CVE-2026-19656

CVE.ORG link : CVE-2026-19656

JSON object : View

Products Affected

scada-lts

scada-lts

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-19656", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19656", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T19:29:37.829898Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "vulnreport@tenable.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "vulnreport@tenable.com", "affectedData": [{"vendor": "SCADA-LTS", "product": "ScadaLTS", "versions": [{"status": "affected", "version": "2.7.8.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-12T20:17:42.933", "references": [{"url": "https://www.tenable.com/security/research/tra-2026-55", "tags": ["Third Party Advisory"], "source": "vulnreport@tenable.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vulnreport@tenable.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ScadaLTS 2.7.8.1\u00a0exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system."}, {"lang": "es", "value": "ScadaLTS 2.7.8.1 expone un m\u00e9todo del lado del servidor que carece de comprobaciones de autorizaci\u00f3n, permitiendo a cualquier usuario autenticado (incluido uno que solo tenga permisos de bajo privilegio y de solo lectura) ejecutar comyos arbitrarios del sistema operativo en el host. La explotaci\u00f3n exitosa resulta en la ejecuci\u00f3n de c\u00f3digo en el contexto del proceso del servidor ScadaLTS (root), lo que lleva a un compromiso total del sistema suporacente."}], "lastModified": "2026-10-23T19:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:scada-lts:scada-lts:2.7.8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2A6612E-7A82-4F25-97FF-C8750A101595"}], "operator": "OR"}]}], "sourceIdentifier": "vulnreport@tenable.com"}