PatchTheCVECVE-2026-19656: ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user
45
This month
CRITICAL 9.9DOWNGRADE
CVE-2026-19656 is a critical-severity flaw (CVSS 9.9) affecting scada-lts. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
Why this priority
- Critical severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.9 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 57%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-08-12 |
| Last modified | 2026-10-23 |
Publisher (CNA): Tenable Network Security, Inc. · Vendor: scada-lts
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
scada-lts scada-lts DOWNGRADE
Affected: 2.7.8.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.7.8.1
1. Check installed version
apt-cache policy scada-lts || rpm -q scada-lts || scada-lts --version
2. No fixed release: DOWNGRADE to a release before 2.7.8.1 (Debian / Ubuntu)
apt-cache madison scada-lts
sudo apt install scada-lts=<VERSION_BEFORE_2.7.8.1>
sudo apt-mark hold scada-lts
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list scada-lts
sudo dnf downgrade scada-lts-<VERSION_BEFORE_2.7.8.1>
sudo dnf versionlock add scada-lts
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · fooyin · FIXED · 0.14.1-6.fc46 · FEDORA-2026-a597ed324c · source
sudo dnf upgrade --advisory=FEDORA-2026-a597ed324c
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-19657 MEDIUM 6.1 DOWNGRADE ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization