CVE-2026-9645 — ScadaBR Vulnerability Analysis

Technical vulnerability analysis and CVE briefing for CVE-2026-9645, affecting the open-source ScadaBR SCADA/HMI platform.

Overview

CVE-2026-9645 is a critical authenticated remote code execution vulnerability in ScadaBR.

According to the prepared briefing:

• Severity: Critical
• CVSS v3.1: 9.9
• Vulnerability Type: Authenticated Remote Code Execution
• CWE: CWE-78 — OS Command Injection
• Affected Product: ScadaBR
• Access Required: Low-privilege authenticated account
• User Interaction: None
• Affected Versions: All known versions
• Patch Status: No official patch available; the project is unmaintained

Vulnerability Summary

The vulnerability allows a logged-in user to submit and execute JavaScript through exposed server-side scripting functionality.

Because the submitted scripts can execute with root-level operating-system privileges and the input is not adequately neutralized, a low-privileged authenticated user may achieve complete compromise of the ScadaBR host.

Attack Flow

The analysis describes the following attack path:

1. Authenticate — Obtain or use a valid ScadaBR account.
2. Reach the scripting API — Access the exposed server-side scripting functionality.
3. Inject OS commands — Malicious input reaches an OS-level execution path.
4. Execute as root — The submitted JavaScript runs with full OS privileges.
5. Full compromise — The attacker can gain root-level control of the affected SCADA host.

CVSS & Security Impact

The vulnerability has a CVSS v3.1 base score of 9.9 (Critical).

CVSS Characteristics

Metric	Value
Attack Vector	Network
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

Potential Impact

• Confidentiality: Unauthorized access to OT/SCADA configuration and data.
• Integrity: Ability to alter control logic and process data.
• Availability: Root-level access may allow disruption or shutdown of monitored systems.

Affected Environments

ScadaBR may be deployed in environments such as:

• Water and wastewater treatment
• Energy and power infrastructure
• Manufacturing and industrial automation
• Building automation

The actual exposure depends on how a specific deployment is configured, segmented, and connected.

Mitigation & Defensive Recommendations

Because no official patch is available, the briefing recommends defensive measures including:

• Isolate ScadaBR within a segmented OT network.
• Block unnecessary internet exposure.
• Restrict web-interface access through a VPN or jump host.
• Disable or remove the scripting feature if it is not required.
• Enforce least-privilege accounts.
• Rotate credentials where appropriate.
• Plan migration to Scada-LTS, the maintained successor project.

Responsible Research

This repository is intended for authorized security research, vulnerability analysis, defensive security, and educational purposes.

Proof-of-concept and exploit code are intentionally not included. The accompanying briefing focuses on understanding the vulnerability, attack conditions, impact, and defensive mitigation.

Documentation

📄 CVE-2026-9645 ScadaBR Vulnerability Analysis

References

• NVD / CVE.org — CVE-2026-9645
• CISA ICS Advisory — ICSA-26-139-03
• ScadaBR project

---

Prepared by Mohammed Hany Mamdouh