ScadaBR unauthenticated remote code execution vulnerability
CISA warns of multiple critical vulnerabilities in ScadaBR 1.2.0 SCADA software enabling unauthenticated remote code execution and system compromise.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an ICS advisory detailing four vulnerabilities affecting ScadaBR version 1.2.0, an open-source SCADA system deployed globally across critical infrastructure sectors. The vulnerabilities enable a range of attacks including unauthenticated injection of arbitrary sensor readings, OS command injection allowing root-level execution, CSRF-based session hijacking, and access via hard-coded credentials. The most severe flaws (CVE-2026-8602, CVE-2026-8603, CVE-2026-8605) permit unauthenticated remote code execution with administrative privileges.
The affected software is used in critical manufacturing, dams, chemical facilities, energy systems, and water/wastewater infrastructure worldwide. ScadaBR has not responded to CISA's coordination attempts, and no vendor patches are available. CISA recommends network isolation, minimizing internet exposure, and implementing VPN-based remote access controls as compensating measures.
No active exploitation has been reported to CISA at this time. Organizations using ScadaBR 1.2.0 should urgently assess their exposure and apply defense-in-depth strategies to limit potential impact until vendor remediation becomes available.
Mentioned in this report
Detection guidance
Shell Process Spawned by Java/Tomcat Service (Possible SCADA Web App Command Injection)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Unix shell being spawned as a child of a Java/Tomcat process, consistent with OS command injection exploitation of a web-facing SCADA application such as ScadaBR. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by Java Process Following Possible Web Exploit
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /java
- /bin/java
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
CommandLine|contains:
- -c
filter:
CommandLine|contains:
- catalina.sh
- startup.sh
- shutdown.sh
condition: selection and not filter
falsepositives:
- Legitimate Tomcat/Java application server startup or maintenance scripts invoking
shell helpers
- Custom monitoring agents that shell out from a Java service for health checks
level: high
tags:
- attack.t1190
- attack.t1059.004
id: 08edda42-5bed-5c08-831f-9c50d59d969f
status: experimental
author: Vorant
Unauthenticated Sensor Data Point Write Request to ScadaBR
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP POST/PUT requests to ScadaBR data point or point-value endpoints without an accompanying session/auth cookie, consistent with unauthenticated injection or manipulation of stored sensor readings. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Write to ScadaBR Data Point Endpoint
logsource:
category: webserver
detection:
selection:
cs-method:
- POST
- PUT
cs-uri-stem|contains:
- /ScadaBR/dataPointDetails
- /ScadaBR/rest/v1/dataPoints
- /ScadaBR/rest/v1/pointValue
filter:
cs-cookie|contains: JSESSIONID
condition: selection and not filter
falsepositives:
- Legitimate integrations or SCADA operator sessions where the session cookie is stripped
or logged in a nonstandard field by the reverse proxy
level: high
tags:
- attack.t1565.001
- attack.t1190
id: 3beb0212-52d9-53a5-b446-34355b9d58b7
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs