What is the CVSS score of CVE-2026-19656?

CVE-2026-19656 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ScadaLTS are affected by CVE-2026-19656?

ScadaLTS 2.7.8.1 contains a critical remote code execution vulnerability allowing any authenticated user to execute arbitrary commands as root.

How to fix or mitigate CVE-2026-19656?

Within 24 hours: inventory all ScadaLTS 2.7.8.1 deployments, isolate affected servers from untrusted networks, and rotate credentials for all user accounts. Within 7 days: implement strict network segmentation limiting SCADA server access to authorized administrative personnel only, deploy network intrusion detection signatures for ScadaLTS exploitation patterns, and audit user accounts to enforce principle of least privilege. Within 30 days: contact vendor for patch availability and release timeline, develop upgrade or migration plan to a patched version or alternative SCADA platform, and implement network-based compensating controls including comprehensive access logging and monitoring.

ScadaLTS CVE-2026-19656

EUVD-2026-57414 CRITICAL

Missing Authorization (CWE-862)

2026-08-12 tenable

GHSA-9cw4-v739-q6qp

Authentication Bypass RCE Scada Lts Scadalts

9.9

CVSS 3.1 · Vendor: tenable

Severity by source

Vendor (tenable) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable web method with low complexity and no UI; a low-privilege authenticated account suffices (PR:L), and root command execution breaching the OS beyond the app justifies S:C with C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (tenable).

CVSS VectorVendor: tenable

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:05 vuln.today

CVE Published

Aug 12, 2026 - 19:10 cve.org

CRITICAL 9.9

DescriptionCVE.org

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.

AnalysisAI

Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-privilege, read-only permissions - invoke a server-side method that performs no authorization check and run arbitrary OS commands. Because the ScadaLTS server process runs as root, a successful call yields full compromise of the underlying host, turning a low-value SCADA login into total system takeover. Reported by Tenable (TRA-2026-55); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

ScadaLTS is an open-source, web-based SCADA/HMI platform (Java/Tomcat) used to monitor and control industrial and building-automation processes. The root cause is CWE-862 (Missing Authorization): a server-side method is reachable by the application's authenticated session layer but never validates that the caller holds the privilege required for the sensitive operation it performs - OS command execution. The affected component is identified by CPE cpe:2.3:a:scada-lts:scadalts:*:*:*:*:*:*:*:* with the impacted release pinned to 2.7.8.1. The compounding factor is that the server process executes as root, so the missing check is not merely a data-exposure issue but a direct path to host-level command execution.

RemediationAI

No vendor-released patch identified at time of analysis; no fixed version is cited in the available data, so upgrade guidance cannot yet reference an exact release - monitor the ScadaLTS project and the Tenable advisory (https://www.tenable.com/security/research/tra-2026-55) for a patched build and apply it as soon as published. As compensating controls in the interim: remove the ScadaLTS web interface from any internet or general-network exposure and restrict it to a dedicated management segment or VPN, since AV:N is the primary reach (trade-off: remote operators lose direct access and need jump-host workflows); tighten account provisioning and revoke unnecessary low-privilege/read-only logins, because PR:L means any valid account is sufficient (trade-off: operational friction for legitimate read-only users); rotate and strengthen all credentials and disable shared/default accounts to shrink the pool of usable logins; and run ScadaLTS under a dedicated non-root service account so that even a successful command-execution call does not immediately yield full host compromise (trade-off: requires reconfiguring file/port permissions the process currently assumes as root).