Is CVE-2026-9646 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9646 being exploited in the wild.

How severe is CVE-2026-9646?

Medium severity, with a CVSS score of 6.1, published 28 May 2026.

Is there a fix for CVE-2026-9646?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9646 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9646?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9646: ScadaBR reflected cross-site scripting in URL handling

CVE-2026-9646 · Severity: medium · CVSS 6.1 · Published 2026-05-28

ScadaBR, an open-source software used for monitoring and controlling industrial processes (SCADA), is vulnerable to a security flaw in how it handles web addresses. An attacker could trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login sessions or sensitive information displayed within the application.

Quick answers

Is CVE-2026-9646 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9646 being exploited in the wild.
How severe is CVE-2026-9646?: Medium severity, with a CVSS score of 6.1, published 28 May 2026.
Which products and versions are affected?: ScadaBR ScadaBR.
Is there a fix for CVE-2026-9646?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9646 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9646?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in ScadaBR due to improper neutralization of script-related HTML tags within URL handling (CWE-80). The vulnerability is reachable over the network without authentication, though it requires user interaction (e.g., clicking a crafted link). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized actions. As of the advisory date, the project appears to be unmaintained and no official patch is available.

Affected products

ScadaBR ScadaBR

Timeline

2026-05-28: advisory: Initial release of Tenable Research Advisory TRA-2026-46
2026-05-28: disclosed: NVD publication date

References

https://www.tenable.com/security/research/tra-2026-46

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.