# CISA warns of multiple critical vulnerabilities in ScadaBR 1.2.0 SCADA software enabling…

Published: 2026-05-19 · Severity: critical · Sectors: manufacturing, infrastructure, energy
Canonical: https://vorant.io/reports/2d3e6263-7333-4db4-afe1-83fa19539b27/cisa-warns-of-multiple-critical-vulnerabilities-in-scadabr-1-2-0-scada-software

> CISA warns of multiple critical vulnerabilities in ScadaBR 1.2.0 SCADA software enabling unauthenticated remote code execution and system compromise.

CISA has published an ICS advisory detailing four vulnerabilities affecting ScadaBR version 1.2.0, an open-source SCADA system deployed globally across critical infrastructure sectors. The vulnerabilities enable a range of attacks including unauthenticated injection of arbitrary sensor readings, OS command injection allowing root-level execution, CSRF-based session hijacking, and access via hard-coded credentials. The most severe flaws (CVE-2026-8602, CVE-2026-8603, CVE-2026-8605) permit unauthenticated remote code execution with administrative privileges.

The affected software is used in critical manufacturing, dams, chemical facilities, energy systems, and water/wastewater infrastructure worldwide. ScadaBR has not responded to CISA's coordination attempts, and no vendor patches are available. CISA recommends network isolation, minimizing internet exposure, and implementing VPN-based remote access controls as compensating measures.

No active exploitation has been reported to CISA at this time. Organizations using ScadaBR 1.2.0 should urgently assess their exposure and apply defense-in-depth strategies to limit potential impact until vendor remediation becomes available.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8602, CVE-2026-8603, CVE-2026-8604, CVE-2026-8605

## Detection guidance (public sample)

### Shell Process Spawned by Java/Tomcat Service (Possible SCADA Web App Command Injection)

ATT&CK: T1059.004

Detects a Unix shell being spawned as a child of a Java/Tomcat process, consistent with OS command injection exploitation of a web-facing SCADA application such as ScadaBR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned by Java Process Following Possible Web Exploit
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /java
    - /bin/java
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    CommandLine|contains:
    - -c
  filter:
    CommandLine|contains:
    - catalina.sh
    - startup.sh
    - shutdown.sh
  condition: selection and not filter
falsepositives:
- Legitimate Tomcat/Java application server startup or maintenance scripts invoking
  shell helpers
- Custom monitoring agents that shell out from a Java service for health checks
level: high
tags:
- attack.t1190
- attack.t1059.004
id: 08edda42-5bed-5c08-831f-9c50d59d969f
status: experimental
author: Vorant
```

### Default Credential Login Attempt to ScadaBR Web Interface

ATT&CK: T1078.001

Detects authentication requests to a ScadaBR web interface using the well-known default admin credentials, indicating use of hard-coded/default accounts to gain access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ScadaBR Login Using Default Admin Credentials
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
    - /ScadaBR/login
    - /ScadaBR/j_security_check
    cs-uri-query|contains:
    - username=admin
    - j_username=admin
    c-uri-query|contains:
    - password=admin
    - j_password=admin
  condition: selection
falsepositives:
- Administrators performing initial setup or credential rotation testing on a freshly
  deployed instance
level: medium
tags:
- attack.t1078.001
- attack.t1190
id: c4352372-7f69-5558-a445-e2016406fed7
status: experimental
author: Vorant
```

### Unauthenticated Sensor Data Point Write Request to ScadaBR

ATT&CK: T1565.001

Detects HTTP POST/PUT requests to ScadaBR data point or point-value endpoints without an accompanying session/auth cookie, consistent with unauthenticated injection or manipulation of stored sensor readings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Write to ScadaBR Data Point Endpoint
logsource:
  category: webserver
detection:
  selection:
    cs-method:
    - POST
    - PUT
    cs-uri-stem|contains:
    - /ScadaBR/dataPointDetails
    - /ScadaBR/rest/v1/dataPoints
    - /ScadaBR/rest/v1/pointValue
  filter:
    cs-cookie|contains: JSESSIONID
  condition: selection and not filter
falsepositives:
- Legitimate integrations or SCADA operator sessions where the session cookie is stripped
  or logged in a nonstandard field by the reverse proxy
level: high
tags:
- attack.t1565.001
- attack.t1190
id: 3beb0212-52d9-53a5-b446-34355b9d58b7
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2d3e6263-7333-4db4-afe1-83fa19539b27/cisa-warns-of-multiple-critical-vulnerabilities-in-scadabr-1-2-0-scada-software.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup