CVE-2026-84858 — Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass

CVE-2026-84858

Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass PUBLISHED

Description (CNA)

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.

Affected (CNA)

Vendor / product	Versions
Scada-LTS / Scada-LTS	affected 2.8.1

CWE

No CWE identifiers supplied.

References

https://www.tenable.com/security/research/tra-2026-60

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.