What is the CVSS score of CVE-2026-19657?

CVE-2026-19657 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

ScadaLTS CVE-2026-19657

EUVD-2026-57417 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 tenable

GHSA-cq6c-v5w8-x82x

XSS Scada Lts Scadalts

6.1

CVSS 3.1 · Vendor: tenable

Severity by source

Vendor (tenable) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS with no auth requirement, mandatory victim click for user interaction, scope changed to browser origin; no availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (tenable).

CVSS VectorVendor: tenable

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:15 vuln.today

DescriptionCVE.org

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.

AnalysisAI

Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that causes the application to echo unsanitized user-supplied input into an HTML response. Because SCADA operators - the likely victims - typically hold privileged authenticated sessions controlling industrial processes, successful exploitation could lead to session token theft, credential harvesting, or unauthorized commands issued through the victim's browser context. No public exploit code and no CISA KEV listing are identified at time of analysis, but the SCADA operational environment elevates the realistic impact of even a medium CVSS score.

Technical ContextAI

ScadaLTS is an open-source SCADA (Supervisory Control and Data Acquisition) web platform derived from Mango Automation, used in industrial environments for monitoring and control of physical processes. The affected component is its web interface, identified by CPE cpe:2.3:a:scada-lts:scadalts:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant: one or more HTTP request parameters are included verbatim in the HTML response without output encoding or Content Security Policy enforcement, allowing an attacker to inject and execute arbitrary JavaScript within the browser's security context for the ScadaLTS origin. The CVSS Scope:Changed (S:C) metric confirms that the injected script crosses the boundary from the web application's trust zone into the victim's browser security context.

RemediationAI

No vendor-released patched version is identified in the available data; the Tenable advisory at https://www.tenable.com/security/research/tra-2026-55 should be monitored for patch availability and an exact fix version. As a compensating control, restrict the ScadaLTS web interface to trusted internal network segments or VPN-only access, eliminating the attacker's ability to deliver crafted URLs from external networks - this addresses the primary external threat vector but does not protect against insider or post-compromise scenarios. Deploying a Web Application Firewall with reflected XSS detection rules in front of ScadaLTS can intercept common payloads, though WAF rules carry bypass risk with advanced encoding and may require tuning to avoid false positives on legitimate ScadaLTS parameters. Educating SCADA operators not to follow unsolicited links to the control interface adds a behavioral layer. If ScadaLTS supports Content Security Policy headers, enabling them to restrict script sources would reduce exploit impact even when a payload is reflected.