PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8153 Universal Robots CVE debrief

CVE-2026-8153 is a critical OS command injection issue affecting the Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1. Because the flaw is described as unauthenticated and allows commands to execute on the robot’s OS, it should be treated as an urgent exposure for any reachable robot controller or engineering network segment. The available official record points to the vendor’s Dashboard Server documentation as the reference source.

Vendor
Universal Robots
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

OT security teams, robotics platform administrators, Universal Robots integrators, and anyone managing PolyScope-enabled robot controllers or adjacent engineering networks should prioritize this issue.

Technical summary

The supplied CVE description states that an attacker can craft commands through the Dashboard Server interface and cause code execution on the robot OS without authentication. NVD maps the weakness to CWE-78 and assigns CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is consistent with remote, low-complexity impact across confidentiality, integrity, and availability. The official reference link points to Universal Robots’ Dashboard Server communication protocol documentation, and the record specifies affected PolyScope versions prior to 5.25.1.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade Universal Robots PolyScope to version 5.25.1 or later as soon as operationally feasible.
  • Restrict network access to Dashboard Server interfaces so they are reachable only from trusted engineering or management hosts.
  • Audit robot controller and engineering network exposure for any unauthenticated access paths to the Dashboard Server service.
  • Review logs, controller behavior, and change history for unexpected commands or configuration changes around the affected interface.
  • Segment robot controllers from broader enterprise networks and limit lateral movement opportunities to OT management systems.
  • Confirm with the vendor’s documentation and release notes that the deployed version includes the relevant fix before returning systems to normal exposure.

Evidence notes

This debrief is based only on the supplied CVE record and the linked official vendor documentation reference. The NVD metadata provided in the corpus states vulnStatus "Awaiting Analysis," references the Universal Robots Dashboard Server documentation, and includes CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-78. The CVE description in the supplied corpus explicitly says the issue affects PolyScope versions prior to 5.25.1 and enables unauthenticated command execution on the robot OS.

Official resources

The CVE was published on 2026-05-08 and modified on 2026-05-11 according to the supplied record. Those CVE dates are the correct disclosure timeline for this debrief.