CVE-2026-19656
⛔ criticalSummary
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
CVSS Score
9.9
Critical
EPSS Score
-
Published Date
2026-08-12
First Seen: 2026-08-13
📊 Relative Risk Intelligence
This CVE is Extremely High Risk - more severe than 98.1% of all 344,170 vulnerabilities in our database.
#6,378
Top 5% most severe
Severity Percentile
🎯 CISA SSVC Assessment Updated: Aug 12, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Total
Complete system compromise possible
🏆 Discovered By
Derrie Sutton, Tenable Research
SSVC data provided by
CISA
Last Modified
2026-08-12
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE IDs (Weakness Types)