Tenable Advisory: ScadaLTS Authenticated RCE (CVE-2026-19656) and XSS (CVE-2026-19657)

Vulnerability Overview Vulnerability Name: ScadaLTS Multiple Vulnerabilities CVE ID: CVE-2026-19656, CVE-2026-19657 Tenable Advisory ID: TRA-2026-55 Credit: Derrie Sutton CVSSv3 Base / Temporal Score: 9.9 / 6.1 CVSSv3 Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Affected Products: ScadaLTS 2.7.8.1 Risk Factor: Critical Impact Scope Vulnerability Types: - CVE-2026-19656: Authenticated Remote Code Execution (AV:N/AC:L/PR:L/UI:N/S:C/H:I:H/A:H) - CVE-2026-19657: Cross-Site Scripting (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Detailed Description: - CVE-2026-19656: Allows any authenticated user (including users with minimal privileges) to execute arbitrary OS commands in the context of the ScadaLTS server process. - CVE-2026-19657: Allows attackers to reflect and execute arbitrary JavaScript in HTML responses via crafted URLs. Remediation Solution: - The vendor indicates that these issues may be fixed in version 2.8.2. - The vendor provided a candidate build for version 2.8.1, which we tested and confirmed has these issues resolved. - As of the release of this advisory, neither of these versions has been officially released. - Tenable recommends upgrading to version 2.8.1 or 2.8.2, or upgrading as soon as possible after their release. Additional References GitHub Link: https://github.com/SCADA-LTS/Scada-LTS Disclosure Timeline January 21, 2026: Tenable sent initial contact request. March 23, 2026: Tenable sent second contact request. March 24, 2026: ScadaLTS responded. March 25, 2026: Tenable sent disclosure information. March 26, 2026: ScadaLTS confirmed disclosure. March 26, 2026: ScadaLTS replied indicating the issue affects other operating systems and will be fixed in the upcoming version 2.8.2. March 28, 2026: Tenable confirmed and inquired if CVEs had been assigned. March 27, 2026: ScadaLTS provided a test version, Tenable requested access. April 2, 2026: Tenable replied indicating that access to the test build had been requested. April 15, 2026: Tenable requested access again and inquired about status updates. June 4, 2026: Tenable suggested that the ScadaLTS vulnerability appeared to be fixed in the provided build, requested an update on the release date, and reminded ScadaLTS of the impending disclosure date. June 17, 2026: Tenable inquired if ScadaLTS had released a new version and reminded them that Tenable would publish its advisory and retain the CVE. Disclaimer All information in TRA advisories is provided "as is" without warranty of any kind, including, but not limited to, warranties of merchantability and fitness for a particular purpose, as well as warranties of completeness, accuracy, or timeliness. It is the responsibility of individuals and organizations to assess the impact of any actual or potential security vulnerabilities. Contact Information Submit Vulnerability Information: Vulnerability Reporting Guidelines Questions or Corrections: bughunters@tenable.com Footer Privacy Policy: Privacy policy Do not sell/share my personal information: Do not sell/share my personal information Legal: Legal GDPR Compliance: GDPR compliance Social Media Links Twitter: Twitter Reddit: Reddit LinkedIn: LinkedIn YouTube: YouTube Copyright Information © 2026 Tenable, Inc. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

Tenable Advisory: ScadaLTS Authenticated RCE (CVE-2026-19656) and XSS (CVE-2026-19657)