PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-19657 SCADA-LTS CVE debrief

ScadaLTS 2.7.8.1 contains a reflected cross-site scripting vulnerability. The CVE record was published on 2026-08-12T20:17:43.060Z and has not been modified since then. Organizations should review and prioritize patching of affected ScadaLTS deployments, focusing on internet-exposed systems and those with high-priority operational roles. The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser session by luring them to visit a crafted URL. This issue requires attention from organizations using ScadaLTS 2.7.8.1, web application security teams, and vulnerability management teams.

Vendor
SCADA-LTS
Product
ScadaLTS
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-12
Original CVE updated
2026-08-25
Advisory published
2026-08-12
Advisory updated
2026-08-25

Who should care

Organizations using ScadaLTS 2.7.8.1, web application security teams, and vulnerability management teams should be aware of this reflected cross-site scripting vulnerability. Internet-exposed ScadaLTS deployments are at higher risk and should be prioritized for patching. Additionally, organizations with high-priority operational roles relying on ScadaLTS should review and address this vulnerability promptly to mitigate potential risks. Security teams responsible for monitoring and incident response should also be informed about this issue to prepare for potential exploitation attempts.

Technical summary

ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without proper sanitization, allowing an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session. This vulnerability is a reflected cross-site scripting (XSS) issue that can be exploited by crafting a URL that, when visited by a victim, executes malicious JavaScript code. The vulnerability exists due to insufficient input validation and sanitization in the affected ScadaLTS version.

Defensive priority

Medium-priority defensive review recommended due to potential for reflected cross-site scripting attacks.

Recommended defensive actions

  • Review and sanitize user-supplied input in HTML responses
  • Implement Content Security Policy (CSP) to restrict JavaScript execution
  • Conduct thorough vulnerability scanning and penetration testing
  • Verify and apply vendor patches or updates
  • Monitor for suspicious activity and implement incident response plan

Evidence notes

Evidence from official CVE and NVD sources indicates ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization, allowing for arbitrary JavaScript execution in a victim's browser session.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-19657 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-19657

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-19657 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-19657

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.