Scadalts
Monthly
Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-privilege, read-only permissions - invoke a server-side method that performs no authorization check and run arbitrary OS commands. Because the ScadaLTS server process runs as root, a successful call yields full compromise of the underlying host, turning a low-value SCADA login into total system takeover. Reported by Tenable (TRA-2026-55); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that causes the application to echo unsanitized user-supplied input into an HTML response. Because SCADA operators - the likely victims - typically hold privileged authenticated sessions controlling industrial processes, successful exploitation could lead to session token theft, credential harvesting, or unauthorized commands issued through the victim's browser context. No public exploit code and no CISA KEV listing are identified at time of analysis, but the SCADA operational environment elevates the realistic impact of even a medium CVSS score.
Privileged remote code execution in ScadaLTS 2.7.8.1 lets any authenticated user - including accounts holding only low-privilege, read-only permissions - invoke a server-side method that performs no authorization check and run arbitrary OS commands. Because the ScadaLTS server process runs as root, a successful call yields full compromise of the underlying host, turning a low-value SCADA login into total system takeover. Reported by Tenable (TRA-2026-55); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that causes the application to echo unsanitized user-supplied input into an HTML response. Because SCADA operators - the likely victims - typically hold privileged authenticated sessions controlling industrial processes, successful exploitation could lead to session token theft, credential harvesting, or unauthorized commands issued through the victim's browser context. No public exploit code and no CISA KEV listing are identified at time of analysis, but the SCADA operational environment elevates the realistic impact of even a medium CVSS score.