CVE-2026-9645 CRITICAL

CVE-2026-9645: ScadaBR Authenticated Remote Code Execution

Vendor Scadabr
Product ScadaBR
Weakness CWE-78
Published May 28, 2026
Last update May 29, 2026

CVSS base score

9.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.

Key dates

02Disclosure timeline

May 28, 2026 CVE published
May 29, 2026 Record updated