CVE-2026-8602 is a missing authentication flaw in ScadaBR 1.2.0 (CVSS 9.1, critical). An unauthenticated attacker can send HTTP GET requests and inject arbitrary sensor readings. CISA says the vendor has not responded, so no fix is confirmed. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The CISA advisory ICSA-26-139-03 lists ScadaBR 1.2.0 as affected. The weakness is CWE-306, missing authentication for a critical function. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
CISA says ScadaBR has not responded to requests to work with it on mitigation, and tells users to contact ScadaBR support. No fixed version is listed. The advisory names critical manufacturing, dams, chemical, energy, and water sectors as deployment areas. The record is not in the CISA KEV catalog.
How to check if you're exposed
Confirm whether ScadaBR runs in your environment and which version.
find / -iname "*scadabr*" -maxdepth 4 2>/dev/null
Then check whether its web port is reachable from outside the control network. Review recorded values for unexplained readings.
What to do now
- Remove ScadaBR from internet reachability today.
- Place it behind a firewall or VPN, with access only for named operators.
- Follow the CISA guidance for control system defence, including network segmentation.
- Check historian data for sensor values that do not match the physical process.
- Contact ScadaBR support and the project repository about a fix or a replacement.
Why it matters
In a SCADA system, data integrity is a safety question. If anyone can write sensor values, operators may make decisions based on false readings.
This entry is one of several for the same version in the CISA advisory, which includes command injection and hard coded credentials. With no vendor fix, isolation is the main protection.
Quick check
Is there a patch?
CISA says the vendor has not responded and lists no fixed version.
Sources
Last reviewed: 19 October 2026.
