Which versions of Scadabr are affected by CVE-2026-8603?

ScadaBR 1.2.0 contains a high-severity OS command injection vulnerability (CVSS 8.7) allowing authenticated users with low-level application access to execute arbitrary commands as root, effectively…

How to fix or mitigate CVE-2026-8603?

Within 24 hours, inventory all ScadaBR 1.2.0 installations across your infrastructure, identify network-accessible instances, and implement immediate network segmentation to restrict access to essential personnel only. Enable comprehensive command execution logging on both the application and underlying operating system. Over the next 7 days, audit all active ScadaBR user accounts, enforce multi-factor authentication for administrative roles, review and strengthen password policies, and document your incident response procedures for SCADA system compromise scenarios. Within 30 days, engage your vendor to understand the patch roadmap and timelines, evaluate alternative SCADA management solutions with active security support, and develop a transition plan that may include architectural changes such as air-gapping critical systems or implementing network-based compensating controls.

Scadabr CVE-2026-8603

Q: What is the CVSS score of CVE-2026-8603?

CVE-2026-8603 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-30961 HIGH

OS Command Injection (CWE-78)

2026-05-19 icscert

GHSA-mj8w-xgc5-j265

Command Injection Scadabr

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (icscert) · only source for this CVE.

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:38 vuln.today

CVE Published

May 19, 2026 - 17:03 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 17:03 cve.org

HIGH 8.7

DescriptionCVE.org

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

AnalysisAI

OS command injection in ScadaBR 1.2.0 lets an authenticated attacker execute arbitrary operating-system commands as root on the underlying SCADA host. Reported through CISA's ICS-CERT (ICSA-26-139-03) and rated CVSS 4.0 8.7, the flaw hands an attacker with low-level application access full control of the industrial control server. There is no public exploit identified at time of analysis, and EPSS is low (0.59%), consistent with CISA's SSVC assessment of no observed exploitation.