Critical severity · published May 28, 2026
CVE-2026-9645
ScadaBR Authenticated Remote Code Execution
9.9
CVSS
0.4%
EPSS
No
On KEV
Description
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
ScadaBR · ScadaBR
1.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9645
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9645
Third Party Advisory
https://www.tenable.com/security/research/tra-2026-46
More from ScadaBR
8.8
CVE-2021-26828
OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
5.4
CVE-2021-26829
OpenPLC ScadaBR Cross-site Scripting Vulnerability
9.8
CVE-2026-8605
Use of Hard-coded Credentials in ScadaBR
9.8
CVE-2026-8603
Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR
9.1
CVE-2026-8602
Missing authentication for critical function in ScadaBR