What is the CVSS score of CVE-2026-9645?

CVE-2026-9645 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ScadaBR are affected by CVE-2026-9645?

ScadaBR, a supervisory control and data acquisition system, contains a remote code execution vulnerability (CVE-2026-9645, CVSS 9.9) allowing authenticated users to execute arbitrary code with root…

How to fix or mitigate CVE-2026-9645?

24 hours: (1) Audit all ScadaBR user accounts and immediately revoke unnecessary administrative access; (2) Implement firewall rules restricting ScadaBR network access to authorized management networks only; (3) Enable comprehensive logging of all server-side method invocations. 7 days: (1) Evaluate and implement network segmentation between ScadaBR and external connectivity; (2) Contact vendor regarding patch timeline and interim guidance; (3) Deploy host-based monitoring for JavaScript execution anomalies. 30 days: (1) Upon vendor patch availability, develop and test patching strategy in isolated environment; (2) Execute patch deployment with formal change control; (3) Conduct post-patch security validation.

ScadaBR CVE-2026-9645

EUVD-2026-33028 CRITICAL

OS Command Injection (CWE-78)

2026-05-28 tenable

GHSA-jqp5-9296-xf42

Command Injection Scadabr

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:20 vuln.today

DescriptionCVE.org

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

AnalysisAI

Remote code execution in ScadaBR allows authenticated users to abuse exposed server-side methods to create and execute arbitrary JavaScript that runs as root, resulting in full host compromise. The CVSS 9.9 rating reflects scope change and complete confidentiality, integrity, and availability impact, and no public exploit is identified at time of analysis despite the issue being formally reported by Tenable Research (TRA-2026-46).

Technical ContextAI

ScadaBR is an open-source SCADA/HMI platform used to monitor and control industrial processes, written in Java and typically deployed as a web application. The CWE-78 (OS Command Injection) classification points to insufficient input sanitization on application-exposed scripting endpoints: the platform legitimately exposes a server-side JavaScript execution facility, but trusts authenticated callers with arbitrary script bodies that the JavaScript engine then evaluates with the privileges of the host process. Because ScadaBR is commonly run as the root user on Linux deployments, code executed through this scripting surface inherits root-level access to the underlying OS, allowing transition from a web-tier compromise to a full host takeover. The single affected CPE 'cpe:2.3:a:scadabr:scadabr:*:*:*:*:*:*:*:*' indicates all known versions are in scope until a fix is published.

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version is cited in the supplied data, so the primary action is to consult the Tenable advisory at https://www.tenable.com/security/research/tra-2026-46 and the upstream ScadaBR project for an updated build before deploying anywhere reachable from untrusted networks. Compensating controls: restrict ScadaBR's web interface to a management VLAN or VPN so that obtaining 'authenticated user' status is itself gated (trade-off: breaks any remote operator workflows); audit and remove non-essential user accounts and strictly limit scripting/administrative roles to a minimum (trade-off: may interfere with operators who legitimately author scripts); run the ScadaBR JVM under a dedicated unprivileged service account inside a container or systemd unit with NoNewPrivileges and a read-only root filesystem (trade-off: requires re-testing process integrations and write paths); and add WAF/reverse-proxy rules blocking POSTs to the scripting endpoints exposed by the application until a fix is available (trade-off: legitimate script management will fail until rules are revoked).