EUVD-2026-80827
GHSA-4vrr-rhf8-cpc9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remotely reachable web interface (AV:N) with a trivial crafted POST (AC:L), but a valid authenticated session is mandatory (PR:L); bypassing authz to reach privileged SCADA methods justifies C:H/I:H/A:H.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass
Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body.
This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.
AnalysisAI
Authorization bypass in ScadaLTS 2.8.1-release-candidate build 0 lets any authenticated user invoke restricted DWR methods by sending a POST to a URL their role is allowed to reach while naming a privileged class and method in the request body, bypassing Spring Security's URL-pattern-only access control; the assessed severity is CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity, and availability impact once the flaw is chained with the other Tenable-reported findings it enables. Exploitation is not anonymous: the attacker must already hold a valid low-privilege ScadaLTS session, and the deployment must run with DWR's crossDomainSessionSecurity setting set to false in web.xml (the default in the affected build), which disables DWR's built-in origin and session validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated ScadaLTS session at any privilege level (PR:L) - the attacker must already possess low-privilege credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authorization-bypass primitive rather than an inflated high-CVSS entry, but its real-world urgency is tempered by the access precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified in the available intelligence at time of analysis, and no exact fixed version can be cited; monitor the Tenable advisory at https://www.tenable.com/security/research/tra-2026-60 and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-84860 for a corrected build, and plan to migrate off the 2.8.1-release-candidate build as soon as a maintained release is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all instances of ScadaLTS 2.8.1-release-candidate build 0, confirm whether DWR crossDomainSessionSecurity is set to false in web.xml, restrict network access to ScadaLTS management and DWR endpoints to trusted administrative networks, and revoke or re-authenticate suspicious low-privilege sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today