# CVE-2026-8603: ScadaBR OS command injection in SCADA system

Source: https://junglewise.ai/threats/cve-2026-8603-scadabr-os-command-injection-in-scada-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-8603 · Severity: info · CVSS 8.8 · Published 2026-05-19

ScadaBR is an open-source software platform used for monitoring and controlling industrial processes in sectors like energy, water, and manufacturing. A security flaw in version 1.2.0 allows an attacker to take full control of the system by executing commands with administrative (root) privileges. This could lead to the disruption of critical infrastructure, unauthorized changes to industrial processes, or the theft of sensitive operational data.

## Quick answers

**Is CVE-2026-8603 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8603 being exploited in the wild.

**How severe is CVE-2026-8603?** Informational severity, with a CVSS score of 8.8, published 19 May 2026.

**Which products and versions are affected?** ScadaBR ScadaBR 1.2.0.

**Is there a fix for CVE-2026-8603?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8603 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8603?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in ScadaBR version 1.2.0. The flaw stems from improper neutralization of special elements used in an OS command, allowing an attacker with low-privileged network access to inject and execute arbitrary commands with root-level permissions. This can lead to full system compromise, including complete loss of confidentiality, integrity, and availability. As of the advisory date, the vendor has not responded to mitigation requests, and no official patch is available. Organizations are advised to isolate SCADA networks from the internet and use VPNs for remote access.

## Affected products

- ScadaBR ScadaBR 1.2.0

## Timeline

- 2026-05-19: advisory: CISA and NVD published the advisory.
- 2026-05-19: disclosed: Initial public disclosure of the vulnerability.

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03)