CVE-2026-8602 Missing authentication for critical function in ScadaBR
Unauthenticated attackers can inject arbitrary sensor readings into the SCADA system via HTTP GET requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8602?
CVE-2026-8602 is a high-severity missing authorization vulnerability in ScadaBR, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
Weakness: CWE-306
Which versions are affected by CVE-2026-8602?
It affects 1 product.
Products include Scadabr Scadabr.
How do I fix CVE-2026-8602?
No fix has been published for CVE-2026-8602 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-8602 being exploited?
There is no known exploitation of CVE-2026-8602 in the wild and no public exploit code.
Other vulnerabilities in ScadaBR
- CVE-2021-26828 OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type
- CVE-2021-26829 OpenPLC ScadaBR Cross-site Scripting
- CVE-2026-9645 ScadaBR Authenticated Remote Code Execution
- CVE-2026-8603 Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR
- CVE-2026-8604 Cross-Site request forgery (CSRF) in ScadaBR
Sources
Also known as GHSA-jvgx-g9vj-2c98.