CVE-2026-9645

⛔ critical

Summary

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

CVSS Score

9.9

Critical

EPSS Score

0.3

Exploit Probability

Published Date

2026-05-28

First Seen: 2026-05-29

📊 Relative Risk Intelligence

This CVE is Extremely High Risk - more severe than 98.2% of all 365,890 vulnerabilities in our database.

#6,548

Top 5% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 29, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Derrie Sutton with Tenable

SSVC data provided by CISA

Last Modified 2026-08-17

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-78

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
scadabr	scadabr	Affected	v1.2

🔗 References 1

https://www.tenable.com/security/research/tra-2026-46

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-9646	🔶 medium	6.1	0.2	A reflected cross-site scripting issue exists in URL handling.	2026-05-28
CVE-2026-8602	⛔ critical	9.1	0.5	In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated at...	2026-05-19
CVE-2026-8603	⛔ critical	9.8	1.3	In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on t...	2026-05-19
CVE-2026-8604	⚠️ high	8.8	0.2	In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a vic...	2026-05-19
CVE-2026-8605	⛔ critical	9.8	0.4	In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA syst...	2026-05-19
CVE-2025-70973	🔶 medium	4.8	0.1	ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated...	2026-03-09

These CVEs affect the same products