Quick answers
- Is CVE-2026-8603 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-8603 being exploited in the wild.
- How severe is CVE-2026-8603?
- Informational severity, with a CVSS score of 8.8, published 19 May 2026.
- Which products and versions are affected?
- ScadaBR ScadaBR 1.2.0.
- Is there a fix for CVE-2026-8603?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-8603 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-8603?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An OS command injection vulnerability (CWE-78) exists in ScadaBR version 1.2.0. The flaw stems from improper neutralization of special elements used in an OS command, allowing an attacker with low-privileged network access to inject and execute arbitrary commands with root-level permissions. This can lead to full system compromise, including complete loss of confidentiality, integrity, and availability. As of the advisory date, the vendor has not responded to mitigation requests, and no official patch is available. Organizations are advised to isolate SCADA networks from the internet and use VPNs for remote access.
Affected products
- ScadaBR ScadaBR 1.2.0
Timeline
- 2026-05-19: advisory: CISA and NVD published the advisory.
- 2026-05-19: disclosed: Initial public disclosure of the vulnerability.