CVE-2026-94148 ScadaBR CVE debrief

Who should care

Defenders and administrators of ScadaBR systems should assess exposure and prioritize upgrading to version 1.2.0. They should also review and verify the export project endpoint security and monitor for potential remote attacks. Additionally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Why it matters

Defenders should care about CVE-2026-94148 as it allows information disclosure in ScadaBR up to 1.1, with remote attacks possible. Upgrading to version 1.2.0 is recommended.

• Information disclosure may occur due to the vulnerability
• Remote attacks are possible, requiring verification of export project endpoint security

Technical summary

The vulnerability is in the EmportDwr.createExportJSON function of the /ScadaBR/export_project.htm file in ScadaBR up to 1.1, allowing information disclosure due to insufficient access controls. The attack can be initiated remotely, and upgrading to version 1.2.0 is recommended to address this issue. The vulnerability has been publicly disclosed, and defenders should assess the exposure of their ScadaBR systems and prioritize upgrading to version 1.2.0. The CVE record and NVD entry provide details on the vulnerability, including its impact and recommended remediation.

Defensive priority

Upgrade to version 1.2.0 to address the vulnerability.

Recommended defensive actions

• Upgrade to version 1.2.0
• Review and verify the export project endpoint
• Monitor for potential remote attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its impact and recommended remediation. The vulnerability was publicly disclosed and may be utilized by attackers. There is no evidence of the vulnerability being exploited in the wild, but defenders should verify the export project endpoint security and monitor for potential remote attacks. The CVE record was published on 2026-09-21T08:16:38.987Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.