Is CVE-2026-9645 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9645 being exploited in the wild.

How severe is CVE-2026-9645?

Critical severity, with a CVSS score of 9.9, published 28 May 2026.

Which products and versions are affected?

ScadaBR ScadaBR All versions (unmaintained).

Is there a fix for CVE-2026-9645?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9645 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9645?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9645: ScadaBR authenticated remote code execution via exposed methods

CVE-2026-9645 · Severity: critical · CVSS 9.9 · Published 2026-05-28

ScadaBR, an open-source software platform used for monitoring and controlling industrial processes (SCADA), contains a critical vulnerability that allows users with basic login credentials to execute malicious code. An attacker can use this flaw to take complete control of the server with administrative (root) privileges. This could lead to the total disruption of industrial operations, theft of sensitive operational data, or a complete system takeover.

Quick answers

Is CVE-2026-9645 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9645 being exploited in the wild.
How severe is CVE-2026-9645?: Critical severity, with a CVSS score of 9.9, published 28 May 2026.
Which products and versions are affected?: ScadaBR ScadaBR All versions (unmaintained).
Is there a fix for CVE-2026-9645?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9645 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9645?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ScadaBR is vulnerable to remote code execution (RCE) due to exposed methods that allow authenticated users to create and execute arbitrary JavaScript code on the server. The vulnerability is classified as OS Command Injection (CWE-78) because the scripts execute with full system access, specifically running as the root user. An attacker with low-privileged network access can exploit this to achieve a complete system compromise. As of the advisory date, the project appears to be unmaintained, and no official patch or fix is available. Security researchers have indicated that the vulnerability has a high impact on confidentiality, integrity, and availability (CVSS 9.9).

Affected products

ScadaBR ScadaBR All versions (unmaintained)

Timeline

2026-05-28: disclosed: Initial release of Tenable research advisory TRA-2026-46.
2026-05-28: advisory: CVE-2026-9645 published to the NVD.

References

https://www.tenable.com/security/research/tra-2026-46

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.