CVE-2026-8603 is an OS command injection in ScadaBR 1.2.0 that lets an attacker run commands as root on the SCADA system (NVD 9.8, CISA 8.8). CISA lists no vendor fix, so isolation and access control are the defence. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The CISA advisory ICSA-26-139-03 lists ScadaBR 1.2.0. The weakness is CWE-78, OS command injection. NVD scores it 9.8, while the CISA advisory scores it 8.8 with a low privilege requirement, so check which scoring you follow.
CISA says the vendor has not responded and points users to ScadaBR support. No fixed version is listed. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check whether ScadaBR is deployed and which user the service runs as.
ps -eo user,pid,cmd | grep -i scadabr
If it runs as root, a command injection gives the attacker full control of the host. Confirm that the web interface is not exposed beyond the control network.
What to do now
- Keep ScadaBR off the internet and off general corporate networks.
- Allow access only from named operator hosts or a VPN.
- Run the service as an unprivileged user if the deployment allows it.
- Rotate the passwords of accounts used on the system, and review who can log in.
- Plan a migration if the vendor does not publish a fix.
Why it matters
Running a web service as root turns any command injection into a full takeover. The record says commands run as root, which is why the impact sits at the top of the scale.
Where a vendor does not respond, buyers carry the risk. Network isolation, strict access and a replacement plan are what remains.
Quick check
Why do NVD and CISA scores differ?
NVD gives 9.8, and CISA lists 8.8 with a low privilege requirement. Both agree the issue is severe.
Sources
Last reviewed: 19 October 2026.
