PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-21410 InSAT CVE debrief

CVE-2026-21410 is a critical SQL injection issue affecting InSAT MasterSCADA BUK-TS. According to the CISA CSAF advisory, the vulnerable main web interface may allow a malicious user to trigger remote code execution. Because the attack vector is network-accessible, requires no privileges, and has no user interaction requirement in the provided CVSS vector, this should be treated as an urgent remediation item for exposed installations.

Vendor
InSAT
Product
MasterSCADA BUK-TS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-24
Original CVE updated
2026-02-24
Advisory published
2026-02-24
Advisory updated
2026-02-24

Who should care

Organizations operating InSAT MasterSCADA BUK-TS, especially OT/ICS environments with the web interface reachable from trusted or untrusted networks. Security teams responsible for industrial control system segmentation, monitoring, and application hardening should prioritize this advisory.

Technical summary

The supplied advisory describes a SQL injection vulnerability in the product’s main web interface. The provided CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which aligns with a network-reachable flaw that can have high confidentiality, integrity, and availability impact. The advisory states that malicious users using the vulnerable endpoint are potentially able to cause remote code execution. No mitigation or patch details were included in the supplied source beyond CISA’s recommendation to contact the vendor.

Defensive priority

Critical. Prioritize immediate assessment of exposure, isolation of affected systems where practical, and rapid vendor coordination for mitigation or compensating controls.

Recommended defensive actions

  • Identify all deployments of InSAT MasterSCADA BUK-TS and confirm whether the main web interface is exposed to untrusted or broadly reachable networks.
  • Restrict network access to the web interface using segmentation, firewall rules, and allowlisting until a vendor fix or validated mitigation is available.
  • Review authentication, logging, and administrative access controls around the affected interface for anomalous activity.
  • Monitor CISA and vendor communications for remediation guidance, and contact the vendor using the advisory-provided addresses if you operate affected products.
  • Apply standard ICS defense-in-depth measures from CISA guidance, including minimizing exposure of OT assets and tightening remote management paths.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-055-01, which identifies CVE-2026-21410 as a SQL injection issue in InSAT MasterSCADA BUK-TS and states that malicious users may be able to cause remote code execution. The advisory also includes the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and lists no KEV status in the provided corpus. Publication and modification timestamps supplied in the corpus are 2026-02-24T07:00:00.000Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-21410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-21410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-21410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-21410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-055-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.