What is the CVSS score of CVE-2026-8153?

CVE-2026-8153 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Universal Robots PolyScope are affected by CVE-2026-8153?

Universal Robots PolyScope Dashboard Server versions before 5.21.1 contain a critical remote command injection vulnerability (CVSS 9.8) that allows unauthenticated attackers to gain complete control…. A patch is available.

How to fix or mitigate CVE-2026-8153?

Within 24 hours: Inventory all PolyScope Dashboard Server deployments and document current versions in use; isolate affected systems from untrusted networks if upgrade is not immediately feasible. Within 7 days: Contact Universal Robots for patch availability timeline and obtain exact fixed version numbers; apply vendor patch to all instances below version 5.21.1 or newer equivalent. Within 30 days: Verify patch deployment across all robots and Dashboard Server instances; implement network segmentation to restrict Dashboard Server access to authorized administrative networks only; enable logging and monitoring for unauthorized access attempts to robot controllers.

Universal Robots PolyScope CVE-2026-8153

EUVD-2026-28548 CRITICAL

OS Command Injection (CWE-78)

2026-05-08 TRO

GHSA-pprv-j56w-x96f

Command Injection Polyscope 5

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 08, 2026 - 13:02 EUVD

Analysis Generated

May 08, 2026 - 12:45 vuln.today

CVE Published

May 08, 2026 - 11:45 nvd

CRITICAL 9.8

DescriptionCVE.org

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.21.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS.

AnalysisAI

Remote unauthenticated command injection in Universal Robots PolyScope Dashboard Server (versions <5.21.1) allows attackers to execute arbitrary OS commands on industrial robot controllers via network-crafted requests. With CVSS 9.8 (critical severity) and complete absence of authentication barriers, this vulnerability enables full robot controller compromise from remote network positions. No authentication, user interaction, or attack complexity required - exploitation is straightforward against default configurations exposing the Dashboard Server interface.

Technical ContextAI

PolyScope is Universal Robots' controller software for CB-series and e-Series collaborative robot arms, providing programming interface and network communications. The Dashboard Server is a TCP socket interface (typically port 29999) used for remote monitoring and control commands. CWE-78 (OS Command Injection) indicates insufficient input validation/sanitization of commands sent to the Dashboard Server, allowing shell metacharacters or command separators to break out of intended command contexts and execute arbitrary system commands. The underlying Linux-based robot controller OS executes these injected commands with the privileges of the Dashboard Server process, likely root or equivalent system-level access given the controller's operational requirements.

RemediationAI

Upgrade Universal Robots PolyScope to version 5.21.1 or later, which addresses the command injection vulnerability per the version boundary stated in the CVE description. Contact Universal Robots support or consult https://www.universal-robots.com/developer/communication-protocol/dashboard-server/ for specific patch installation procedures and compatibility validation with deployed robot hardware models. If immediate patching is not operationally feasible, implement network-level compensating controls: (1) Block external access to Dashboard Server port 29999 via firewall rules, restricting connectivity to dedicated HMI/SCADA systems on isolated OT network segments only - trade-off is loss of remote monitoring/control from IT network; (2) Deploy application-layer gateway or protocol proxy that validates Dashboard Server commands against whitelist of known-safe command syntax before forwarding to robot controller - requires deep protocol knowledge and introduces single point of failure; (3) Enable any authentication mechanisms available in PolyScope safety/access control settings if supported in your robot series - verify in controller documentation as not all models support authentication on Dashboard Server. Network segmentation is most reliable immediate control but does not eliminate risk from threats already inside OT network perimeter.