CVE-2026-9645
ScadaBR Authenticated Remote Code Execution
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
| CWE | CWE-78 |
| Vendor | scadabr |
| Product | scadabr |
| Published | May 28, 2026 |
| Last Updated | May 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for scadabr scadabr
Be the first to know when new critical vulnerabilities affecting scadabr scadabr are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
ScadaBR / ScadaBR
1.2.0
References
Credits
Derrie Sutton with Tenable