by Kastro
Paper/Archive/CVE-2026-9645

CVE-2026-9645

ScadaBR ScadaBR — ScadaBR Authenticated Remote Code Execution

EPSS 0.4%CVSS 9.9
critical.is priorityof 100
37
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 35.4.354 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

Affected

ProductAffectedFixed inSource
ScadaBR1.2.0–CNA

Scores by source

tenable (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reftenable.com/security/research/tra-2026-46