ScadaLTS EUVD-2026-80825

Requires a valid low-privilege Scada-LTS user account (per CVSS PR:L and the description's 'access to a low privilege user'), and network reachability to the application's DWR interface. The specific trigger is the DataSourceEditDwr.validateScript DWR method, which performs no authorization check and is reachable via a DWR routing bypass, then compiles and executes the supplied JavaScript through the Rhino engine. No user interaction and no non-default configuration are needed - the vulnerable method is exposed by the standard build (2.8.1-release-candidate build 0). The primary limiting factor is authentication: an attacker must first hold or obtain credentials for any account; instances not exposed to the attacker's network and instances requiring MFA/hardened access are correspondingly harder to reach.

This is a genuine, credible priority rather than an inflated high-CVSS artifact. The vendor CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-aligned with the described mechanism: a network-reachable DWR endpoint (DataSourceEditDwr.validateScript) that compiles and runs attacker-supplied JavaScript through the Rhino engine, yielding code execution on the server. The PR:L rating is consistent with the description's 'authenticated ... low privilege user' framing, and the 'DWR routing bypass' plus absence of authorization checks on the method mean even a low-privilege account escalates directly to RCE - a large real-world jump. Signals are thin but not conflicting: no EPSS score, no CISA KEV entry, and no public POC are present in the input, so there is no evidence of active exploitation or mass automation. The finding is from Tenable research (TRA-2026-60), a reputable source, which raises confidence in the technical accuracy even though it lowers the likelihood of opportunistic mass exploitation. Net: treat as a high-priority patch/mitigation target for any exposed Scada-LTS instance because impact is full server compromise and complexity is low, while acknowledging exploitation currently appears to require valid low-privilege credentials and there is no confirmed in-the-wild activity.

An attacker who has obtained any low-privilege Scada-LTS account (or credentials via phishing/reuse) sends a crafted DWR request to the DataSourceEditDwr.validateScript method, supplying malicious JavaScript that the Rhino engine compiles and executes on the server, achieving remote code execution in the application's context. Because the method lacks authorization checks and is reachable through a DWR routing bypass, the low-privilege role restriction is meaningless. No public exploit code is identified in the provided data, though Tenable's advisory (TRA-2026-60) documents the technique in detail.