CVE-2026-84858CWE-94code-injection

CVE-2026-84858

High · published September 16, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass

The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00838 · 57.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-16T19:18Z
References (1)
https://www.tenable.com/security/research/tra-2026-60 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 16 SEP 14:51Z
    Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass
    cvelistv5