ScadaBR – Multiple Vulnerabilities

Multiple vulnerabilities affect ScadaBR. Tenable was unsuccessful in contacting the project. Recent publications indicate similar difficulty.

CVE-2026-9645 Authenticated Remote Code Execution (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

CVE-2026-9646 Unauthenticated Reflected Cross-Site Scripting (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

A reflected cross-site scripting issue exists in URL handling.