ScadaLTS EUVD-2026-80827

Requires a valid authenticated ScadaLTS session at any privilege level (PR:L) - the attacker must already possess low-privilege credentials. The deployment must run with DWR's crossDomainSessionSecurity setting configured to false in web.xml (the default in the affected build), which disables DWR's built-in origin/session validation and is the enabling misconfiguration. Exploitation targets the DWR dispatch layer: the attacker sends a POST to any URL their role is authorized to reach (e.g. MiscDwr.initializeLongPoll.dwr) while naming a restricted class/method in the c0-scriptName and c0-methodName body parameters, defeating Spring Security's URL-pattern-only access control. Limiting factors: valid credentials are mandatory (no anonymous exploitation), the flaw is specific to ScadaLTS 2.8.1-release-candidate build 0's DWR/Spring Security configuration, and full impact is realized in combination with the other Tenable-reported findings that this root cause unlocks.

This is a genuine authorization-bypass primitive rather than an inflated high-CVSS entry, but its real-world urgency is tempered by the access precondition. The vendor CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is broadly defensible: the flaw is remotely reachable over the web interface, trivially triggered by crafting a DWR POST body, and - because it is described as the 'systemic root cause' that lets a low-privilege user reach restricted DWR classes/methods - the confidentiality/integrity/availability impacts of a full SCADA/HMI compromise (C:H/I:H/A:H) are plausible when chained with the other Tenable findings. The one metric worth scrutiny is PR:L: exploitation explicitly requires an already-authenticated session ('any authenticated user'), so this is a privilege-escalation/authorization bypass, not an unauthenticated compromise - the CVSS vector and the description agree on this point (PR:L is correct, not PR:N). No EPSS score, CISA KEV listing, or public POC is present in the supplied data; only a Tenable research advisory (TRA-2026-60) documenting the mechanism. Net: real and structurally serious for exposed ScadaLTS instances, but gated behind valid credentials and confined to a niche product, so it is a targeted-risk 'patch promptly on exposed deployments' item rather than a mass-exploitation emergency.

A low-privilege but authenticated ScadaLTS user (e.g. a read-only operator account) sends a normal DWR POST to an endpoint their role is permitted to reach, such as MiscDwr.initializeLongPoll.dwr, but sets the c0-scriptName and c0-methodName body parameters to point at a restricted DWR class/method that Spring Security only guards by URL path. Because crossDomainSessionSecurity=false disables DWR's origin validation, the call executes with the attacker's authenticated session, bypassing the URL-based access control and unlocking privileged SCADA operations that other Tenable findings can then abuse. No public exploit code is identified in the supplied data, though Tenable has published a technical advisory describing the technique.