Authenticated remote code execution in ScadaLTS (CVE-2026-19656)

ScadaLTS 2.7.8.1 exposes a server-side method without authorization checks, allowing any authenticated user, including those with only low-privilege read-only permissions, to execute arbitrary operating system commands on the underlying host. Successful exploitation results in code execution as root in the context of the ScadaLTS server process, leading to full compromise of the host. Affected versions: - 2.7.8.1 We recommend updating to: 2.8.1, 2.8.2. CVSS 9.9 · our assessment: act_now Reference: https://www.tenable.com/security/research/tra-2026-55 Details: https://vuln.today/cve/CVE-2026-19656