CISA warns of multiple critical vulnerabilities in ScadaBR 1.2.0 SCADA software enabling…
CISA warns of multiple critical vulnerabilities in ScadaBR 1.2.0 SCADA software enabling unauthenticated remote code execution and system compromise.
CISA has published an ICS advisory detailing four vulnerabilities affecting ScadaBR version 1.2.0, an open-source SCADA system deployed globally across critical infrastructure sectors. The vulnerabilities enable a range of attacks including unauthenticated injection of arbitrary sensor readings, OS command injection allowing root-level execution, CSRF-based session hijacking, and access via hard-coded credentials. The most severe flaws (CVE-2026-8602, CVE-2026-8603, CVE-2026-8605) permit unauthenticated remote code execution with administrative privileges.
The affected software is used in critical manufacturing, dams, chemical facilities, energy systems, and water/wastewater infrastructure worldwide. ScadaBR has not responded to CISA's coordination attempts, and no vendor patches are available. CISA recommends network isolation, minimizing internet exposure, and implementing VPN-based remote access controls as compensating measures.
No active exploitation has been reported to CISA at this time. Organizations using ScadaBR 1.2.0 should urgently assess their exposure and apply defense-in-depth strategies to limit potential impact until vendor remediation becomes available.
Mentioned in this report
Detection guidance
Shell Process Spawned by Java/Tomcat Service (Possible SCADA Web App Command Injection)
Detects a Unix shell being spawned as a child of a Java/Tomcat process, consistent with OS command injection exploitation of a web-facing SCADA application such as ScadaBR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by Java Process Following Possible Web Exploit
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /java
- /bin/java
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
CommandLine|contains:
- -c
filter:
CommandLine|contains:
- catalina.sh
- startup.sh
- shutdown.sh
condition: selection and not filter
falsepositives:
- Legitimate Tomcat/Java application server startup or maintenance scripts invoking
shell helpers
- Custom monitoring agents that shell out from a Java service for health checks
level: high
tags:
- attack.t1190
- attack.t1059.004
id: 08edda42-5bed-5c08-831f-9c50d59d969f
status: experimental
author: Vorant
Default Credential Login Attempt to ScadaBR Web Interface
Detects authentication requests to a ScadaBR web interface using the well-known default admin credentials, indicating use of hard-coded/default accounts to gain access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ScadaBR Login Using Default Admin Credentials
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains:
- /ScadaBR/login
- /ScadaBR/j_security_check
cs-uri-query|contains:
- username=admin
- j_username=admin
c-uri-query|contains:
- password=admin
- j_password=admin
condition: selection
falsepositives:
- Administrators performing initial setup or credential rotation testing on a freshly
deployed instance
level: medium
tags:
- attack.t1078.001
- attack.t1190
id: c4352372-7f69-5558-a445-e2016406fed7
status: experimental
author: Vorant
Unauthenticated Sensor Data Point Write Request to ScadaBR
Detects HTTP POST/PUT requests to ScadaBR data point or point-value endpoints without an accompanying session/auth cookie, consistent with unauthenticated injection or manipulation of stored sensor readings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Write to ScadaBR Data Point Endpoint
logsource:
category: webserver
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /ScadaBR/dataPointDetails
- /ScadaBR/rest/v1/dataPoints
- /ScadaBR/rest/v1/pointValue
filter:
cs-cookie|contains: JSESSIONID
condition: selection and not filter
falsepositives:
- Legitimate integrations or SCADA operator sessions where the session cookie is stripped
or logged in a nonstandard field by the reverse proxy
level: high
tags:
- attack.t1565.001
- attack.t1190
id: 3beb0212-52d9-53a5-b446-34355b9d58b7
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free