VORANT. Threat Intelligence Sign in Get the full feed

OPC UA LocalDiscoveryServer Installer Privilege Flaw

routine vulnerability energymanufacturinginfrastructure

A local privilege-escalation flaw in OPCFoundation's OPC UA LDS installer lets an attacker hijack a high-privilege console during setup to run arbitrary commands.

CISA has published an advisory for CVE-2026-77477, a vulnerability affecting OPCFoundation's OPC UA LocalDiscoveryServer (LDS) installers prior to version 1.04.420. The flaw stems from execution with unnecessary privileges (CWE-250): during installation, a high-privilege console window is launched that an attacker with local keyboard/display access can intercept, allowing them to run arbitrary commands with elevated privileges. Exploitation requires the attacker to be able to launch the installer with elevated privileges and have physical or interactive access to the keyboard and display at the time of installation - it is not exploitable remotely.

OPC UA is widely deployed across critical infrastructure sectors including Chemical, Energy, Food and Agriculture, Water and Wastewater, and Critical Manufacturing, with deployments worldwide. The vendor is headquartered in the United States. CISA notes no known public exploitation of this vulnerability has been reported at this time. The vulnerability was responsibly disclosed by Lukas Schumaker of Rockwell Automation.

OPCFoundation recommends updating LDS Installers to version 1.04.420 or later. Given the local-access requirement and absence of active exploitation, this represents a routine patch-management item for ICS operators rather than an urgent threat, though organizations performing installations in shared or physically accessible environments should apply the update promptly.

Mentioned in this report

Vulnerabilities CVE-2026-77477

Detection guidance

OPC UA LocalDiscoveryServer Installer Spawning Interactive Command Shell

ATT&CK T1574

OPC UA LDS installer process launching cmd.exe or powershell.exe with elevated privileges during installation - indicator of privilege escalation exploitation via high-privilege console window interception. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: OPC UA LocalDiscoveryServer Installer Spawning Interactive Command Shell
description: Detects OPC UA LocalDiscoveryServer installer launching cmd.exe or powershell.exe
  during execution. The vulnerability allows attackers with local access to intercept
  a high-privilege console window spawned during installation and execute arbitrary
  commands with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: lds
    ParentImage|endswith: .exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    IntegrityLevel|endswith:
    - High
    - System
  filter_legitimate_install:
    CommandLine|contains:
    - /c systeminfo
    - /c ipconfig
  condition: selection and not filter_legitimate_install
falsepositives:
- Legitimate OPC UA LDS installation scripts that invoke system commands for configuration
  validation
- Administrative tooling that drives OPC UA installer from elevated contexts
level: medium
id: d4ca332c-cbd8-5544-be35-c7fa165c1a35
status: experimental
author: Vorant

Suspicious Process Execution from OPC UA LocalDiscoveryServer Installation Directory

ATT&CK T1574

Arbitrary executable spawned from OPC UA LDS installation directory (Program Files/OPC) with elevated privilege level during or immediately after installer execution - sign of privilege-escalation payload injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Execution from OPC UA LocalDiscoveryServer Installation
  Directory
description: Detects child processes spawned from the OPC UA LocalDiscoveryServer
  installation directory with elevated privileges. The LDS installer vulnerability
  allows execution of arbitrary commands with high privileges via console window interception,
  resulting in malicious binaries or scripts placed in or launched from the installation
  path.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
    - Program Files\OPC
    - Program Files (x86)\OPC
    IntegrityLevel|endswith:
    - High
    - System
  filter_opc_legitimate:
    Image|endswith:
    - \OpcEnum.exe
    - \OpcUaServerExe.exe
    - \LdsServer.exe
  condition: selection and not filter_opc_legitimate
falsepositives:
- OPC UA service binaries and legitimate OPC Foundation tools launched during normal
  system operation
- Administrative utilities updating or maintaining OPC installations from elevated
  sessions
level: medium
id: bbb99346-1eac-5c13-a5e8-426b91f5a454
status: experimental
author: Vorant

OPC UA LocalDiscoveryServer Installer Execution with Elevated Privileges

ATT&CK T1574

OPC UA LDS installer (lds*.exe or *LDS*installer*.exe) executed with High or System integrity level outside of standard Windows Installer context - prerequisite for console-window privilege escalation attack. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: OPC UA LocalDiscoveryServer Installer Execution with Elevated Privileges
description: Detects OPC UA LocalDiscoveryServer installer binaries running with elevated
  integrity (High or System) outside of standard MSI/Windows Installer execution context.
  This is the necessary condition for exploitation of CVE-2026-77477, where a high-privilege
  console window can be intercepted by a local attacker to run arbitrary commands.
tags:
- attack.privilege-escalation
- attack.t1574
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|re: (?i)lds.*\.exe$|.*lds.*installer.*\.exe$
    IntegrityLevel|endswith:
    - High
    - System
  filter_msiexec:
    ParentImage|endswith: \msiexec.exe
  filter_windows_install:
    ParentCommandLine|contains:
    - Windows Update
    - SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate
  condition: selection and not (filter_msiexec or filter_windows_install)
falsepositives:
- Legitimate OPC UA LDS installation triggered by administrators in elevated contexts
- Automated deployment scripts pushing OPC UA updates from configuration management
  tools
level: low
id: 7bfea402-5404-53e2-9564-cd3b9a1c7114
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-01

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free