CVE-2026-115803 Scada-LTS CVE debrief

Who should care

Defenders responsible for Scada-LTS deployments, especially those using the AmCharts Data API, should assess exposure and monitor for potential exploitation attempts. This includes verifying exposure of Scada-LTS 2.8.0 deployments and implementing security enhancements from the vendor's upcoming release.

Why it matters

CVE-2026-115803 is a vulnerability in Scada-LTS 2.8.0 that allows for authorization bypass. Defenders should prioritize verifying exposure and monitoring for exploitation attempts.

• Verify exposure of Scada-LTS 2.8.0 deployments.
• Monitor for potential exploitation attempts.
• Implement security enhancements from the vendor's upcoming release.

Technical summary

The vulnerability affects Scada-LTS 2.8.0, specifically the AmCharts Data API. The HttpServletRequest.getParameter function in AmChartValuesAPI.java is vulnerable to manipulation of the 'ids' argument, leading to authorization bypass. This issue can be exploited remotely. Defenders should prioritize verifying exposure of Scada-LTS 2.8.0 deployments, especially those using the AmCharts Data API, and monitor for potential exploitation attempts. The vendor is working on a new release with security enhancements which should be implemented.

Defensive priority

Defenders should prioritize verifying exposure of Scada-LTS 2.8.0 deployments, especially those using the AmCharts Data API, and monitor for potential exploitation attempts.

Recommended defensive actions

• Verify Scada-LTS 2.8.0 deployments for exposure, especially those using the AmCharts Data API.
• Monitor for potential exploitation attempts.
• Review and implement security enhancements from the vendor's upcoming release.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, information on affected versions, exploitation, and remediation is limited. Defenders should verify exposure of Scada-LTS 2.8.0 deployments, especially those using the AmCharts Data API, and monitor for potential exploitation attempts. The vendor's upcoming release with security enhancements should be reviewed and implemented.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.