CVE-2026-84860 Scada-LTS CVE debrief

Who should care

Defenders responsible for ScadaLTS deployments should assess exposure and potential impact. System administrators and security teams should verify the version and configuration of ScadaLTS and implement compensating controls to restrict access to DWR methods.

Why it matters

CVE-2026-84860 is a high-severity vulnerability affecting ScadaLTS 2.8.1-release-candidate build 0, allowing unauthorized access to DWR methods. Defenders should prioritize verifying exposure and assessing potential impact.

• Potential unauthorized access to DWR methods
• Possible exploitation by authenticated users
• Need for verification of ScadaLTS version and configuration
• Requirement for compensating controls to restrict access to DWR methods

Technical summary

The vulnerability is caused by an authorization bypass issue in Spring Security and DWR endpoints. The crossDomainSessionSecurity setting in web.xml is set to false, disabling DWR's built-in origin validation. This allows an authenticated user to invoke any DWR method by sending a request to a permitted URL while targeting a restricted class in the POST body. The affected product, ScadaLTS 2.8.1-release-candidate build 0, may be exposed to unauthorized access. Defenders should assess the potential impact and verify exposure.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability allows for unauthorized access to DWR methods.

Recommended defensive actions

• Verify exposure by checking the ScadaLTS version and configuration
• Assess potential impact by evaluating the DWR methods accessible to authenticated users
• Implement compensating controls to restrict access to DWR methods
• Monitor for suspicious activity targeting DWR endpoints
• Review vendor guidance for ScadaLTS 2.8.1-release-candidate build 0
• Perform an asset inventory to identify potentially affected systems
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability is attributed to an authorization bypass issue in Spring Security and DWR endpoints. The crossDomainSessionSecurity setting in web.xml is set to false, disabling DWR's built-in origin validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.