CVE-2026-9645CWE-78command-injection

CVE-2026-9645

Critical · published May 29, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00524 · 43.6th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-29T01:16Z
Affected products (1)
ProductVersionsFixed in
scadabr/scadabrall versions—
References (1)
https://www.tenable.com/security/research/tra-2026-46 · [email protected]
EPSS history
Timeline
  • 28 MAY 20:30Z
    ScadaBR Authenticated Remote Code Execution
    cvelistv5