CVE-2026-34184 is a critical (CVSS 9.1) missing authorization flaw in AlanWeb SCADA, from Control System. Some directories can be read and even run without a login. The fix is version 9.8.5, so upgrade and keep SCADA web interfaces off the open internet.
What's affected
CERT Polska lists all AlanWeb SCADA versions below 9.8.5 as affected, and the record says the issue was fixed in 9.8.5. The vendor is Control System (control-system.pl).
The description says the product does not enforce authorization for some directories. An unauthorized attacker can read all files in them and can run some of them. It adds that the attacker could run PHP scripts directly against the connected database.
The same CERT Polska notice covers other flaws in the product fixed in the same version, including CVE-2026-4901 (sensitive information in a log file) and CVE-2026-34185 (SQL injection). One upgrade deals with them all.
How to check if you're exposed
Open the AlanWeb SCADA admin or about page and check the version against 9.8.5. If your integrator maintains the system, ask them for the version and the patch plan in writing.
Then check how the web interface is reached. A SCADA web front end should sit on an internal or isolated network, reachable through a VPN, never directly on the internet. Run an external check from your own address space to see whether the interface answers.
Review web server logs for requests to directories that normally need a session.
What to do now
- Confirm the AlanWeb SCADA version in each installation.
- Upgrade to 9.8.5 or later, working with your integrator and following your change process for operational systems.
- Take the web interface off the internet and put it behind a VPN or a jump host.
- Review web logs and the database for activity you cannot explain.
- Rotate database credentials used by the application.
- Make sure backups of the SCADA configuration and database are current before the change.
Why it matters
The weakness is CWE-862, missing authorization. Authentication asks who you are, and authorization asks what you may do. Here the application did not check the second question for some directories at all, so files, and some executable scripts, were reachable to anyone.
The consequence is larger in a SCADA setting, where the web layer sits next to the database that records process data. Web access to the system should therefore be treated as access to operations. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
Quick check
Is there a workaround if I cannot upgrade now?
The sources I read do not describe one. Restrict network access to the interface and ask the vendor or your integrator for guidance.
Sources
Last reviewed: 19 October 2026.
