OPC UA LocalDiscoveryServer Installer Privilege Flaw
A local privilege-escalation flaw in OPCFoundation's OPC UA LDS installer lets an attacker hijack a high-privilege console during setup to run arbitrary commands.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has published an advisory for CVE-2026-77477, a vulnerability affecting OPCFoundation's OPC UA LocalDiscoveryServer (LDS) installers prior to version 1.04.420. The flaw stems from execution with unnecessary privileges (CWE-250): during installation, a high-privilege console window is launched that an attacker with local keyboard/display access can intercept, allowing them to run arbitrary commands with elevated privileges. Exploitation requires the attacker to be able to launch the installer with elevated privileges and have physical or interactive access to the keyboard and display at the time of installation - it is not exploitable remotely.
OPC UA is widely deployed across critical infrastructure sectors including Chemical, Energy, Food and Agriculture, Water and Wastewater, and Critical Manufacturing, with deployments worldwide. The vendor is headquartered in the United States. CISA notes no known public exploitation of this vulnerability has been reported at this time. The vulnerability was responsibly disclosed by Lukas Schumaker of Rockwell Automation.
OPCFoundation recommends updating LDS Installers to version 1.04.420 or later. Given the local-access requirement and absence of active exploitation, this represents a routine patch-management item for ICS operators rather than an urgent threat, though organizations performing installations in shared or physically accessible environments should apply the update promptly.
Mentioned in this report
Detection guidance
OPC UA LocalDiscoveryServer Installer Spawning Interactive Command Shell
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
OPC UA LDS installer process launching cmd.exe or powershell.exe with elevated privileges during installation - indicator of privilege escalation exploitation via high-privilege console window interception. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OPC UA LocalDiscoveryServer Installer Spawning Interactive Command Shell
description: Detects OPC UA LocalDiscoveryServer installer launching cmd.exe or powershell.exe
during execution. The vulnerability allows attackers with local access to intercept
a high-privilege console window spawned during installation and execute arbitrary
commands with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: lds
ParentImage|endswith: .exe
Image|endswith:
- \cmd.exe
- \powershell.exe
IntegrityLevel|endswith:
- High
- System
filter_legitimate_install:
CommandLine|contains:
- /c systeminfo
- /c ipconfig
condition: selection and not filter_legitimate_install
falsepositives:
- Legitimate OPC UA LDS installation scripts that invoke system commands for configuration
validation
- Administrative tooling that drives OPC UA installer from elevated contexts
level: medium
id: d4ca332c-cbd8-5544-be35-c7fa165c1a35
status: experimental
author: Vorant
Suspicious Process Execution from OPC UA LocalDiscoveryServer Installation Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Arbitrary executable spawned from OPC UA LDS installation directory (Program Files/OPC) with elevated privilege level during or immediately after installer execution - sign of privilege-escalation payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Execution from OPC UA LocalDiscoveryServer Installation
Directory
description: Detects child processes spawned from the OPC UA LocalDiscoveryServer
installation directory with elevated privileges. The LDS installer vulnerability
allows execution of arbitrary commands with high privileges via console window interception,
resulting in malicious binaries or scripts placed in or launched from the installation
path.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- Program Files\OPC
- Program Files (x86)\OPC
IntegrityLevel|endswith:
- High
- System
filter_opc_legitimate:
Image|endswith:
- \OpcEnum.exe
- \OpcUaServerExe.exe
- \LdsServer.exe
condition: selection and not filter_opc_legitimate
falsepositives:
- OPC UA service binaries and legitimate OPC Foundation tools launched during normal
system operation
- Administrative utilities updating or maintaining OPC installations from elevated
sessions
level: medium
id: bbb99346-1eac-5c13-a5e8-426b91f5a454
status: experimental
author: Vorant
OPC UA LocalDiscoveryServer Installer Execution with Elevated Privileges
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
OPC UA LDS installer (lds*.exe or *LDS*installer*.exe) executed with High or System integrity level outside of standard Windows Installer context - prerequisite for console-window privilege escalation attack. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: OPC UA LocalDiscoveryServer Installer Execution with Elevated Privileges
description: Detects OPC UA LocalDiscoveryServer installer binaries running with elevated
integrity (High or System) outside of standard MSI/Windows Installer execution context.
This is the necessary condition for exploitation of CVE-2026-77477, where a high-privilege
console window can be intercepted by a local attacker to run arbitrary commands.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
category: process_creation
product: windows
detection:
selection:
Image|re: (?i)lds.*\.exe$|.*lds.*installer.*\.exe$
IntegrityLevel|endswith:
- High
- System
filter_msiexec:
ParentImage|endswith: \msiexec.exe
filter_windows_install:
ParentCommandLine|contains:
- Windows Update
- SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate
condition: selection and not (filter_msiexec or filter_windows_install)
falsepositives:
- Legitimate OPC UA LDS installation triggered by administrators in elevated contexts
- Automated deployment scripts pushing OPC UA updates from configuration management
tools
level: low
id: 7bfea402-5404-53e2-9564-cd3b9a1c7114
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-01
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs