CVE-2026-36226: Advantech WebAccess/SCADA XSS Flaw

CVE-2026-36226 Overview

CVE-2026-36226 is a Cross-Site Scripting (XSS) vulnerability affecting Advantech WebAccess/SCADA version 8.0-2015.08.16. The flaw resides in the decryption field of the Create New Project User component. A remote attacker can inject malicious script content that executes in the context of a victim user's browser session. Successful exploitation requires user interaction, such as visiting a crafted link or page. The vulnerability is tracked under CWE-79 and can be used to obtain sensitive information from the targeted SCADA operator interface.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated operator's browser to steal session data and sensitive information from the WebAccess/SCADA interface.

Affected Products

Advantech WebAccess/SCADA 8.0-2015.08.16
WebAccess/SCADA Create New Project User component
Web-based SCADA management interface

Discovery Timeline

2026-05-22 - CVE CVE-2026-36226 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-36226

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting (XSS) issue in the web-based interface of Advantech WebAccess/SCADA. The decryption field within the Create New Project User component fails to sanitize or encode user-supplied input. Attacker-controlled script content is rendered directly in the HTML response delivered to the operator's browser.

The issue is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation. Exploitation depends on a user interacting with a crafted request or visiting a malicious page that submits the payload. Because the attack changes scope by executing in the trusted SCADA web origin, the attacker gains access to data that the victim's session is authorized to view.

Root Cause

The root cause is missing output encoding and input validation on the decryption parameter handled by the Create New Project User functionality. The application reflects supplied data into the HTML document without applying context-appropriate escaping, allowing <script> tags and event handlers to execute.

Attack Vector

The attack is network-based and requires user interaction. An attacker delivers a crafted URL or form submission targeting the vulnerable endpoint. When an authenticated WebAccess/SCADA user processes the payload, the injected script runs in the browser. The attacker can read DOM content, exfiltrate cookies that are not marked HttpOnly, capture keystrokes within the page, and pivot to additional actions permitted by the user's session. No verified public exploit code is documented in the NVD record; a proof-of-concept reference is maintained at the GitHub PoC Repository.

Detection Methods for CVE-2026-36226

Indicators of Compromise

HTTP requests to the Create New Project User endpoint containing <script>, javascript:, onerror=, or onload= tokens in the decryption parameter.
Outbound browser connections from operator workstations to unfamiliar domains immediately after WebAccess/SCADA page loads.
Web server access logs showing URL-encoded HTML or JavaScript characters such as %3Cscript%3E in form fields.

Detection Strategies

Inspect WebAccess/SCADA web server logs for parameter values containing script syntax, angle brackets, or known XSS polyglots.
Deploy a web application firewall (WAF) rule set covering OWASP Core Rule Set categories for reflected and stored XSS targeting the SCADA interface.
Correlate authenticated session activity with anomalous JavaScript-driven requests, such as background fetches to non-SCADA hosts.

Monitoring Recommendations

Enable verbose HTTP request logging on the WebAccess/SCADA server and forward logs to a centralized SIEM for retention and correlation.
Monitor operator workstation browsers for unexpected redirects or pop-ups when working within the SCADA portal.
Alert on any modification of project user records that occurs outside scheduled administrative windows.

How to Mitigate CVE-2026-36226

Immediate Actions Required

Restrict network access to the WebAccess/SCADA web interface using firewall rules and VPN-only access for engineering workstations.
Instruct operators to avoid clicking external links while authenticated to the WebAccess/SCADA console.
Audit existing project user records and HTTP logs for evidence of script content submitted through the decryption field.

Patch Information

No vendor patch reference is listed in the NVD record at the time of publication. Operators running Advantech WebAccess/SCADA 8.0-2015.08.16 should contact Advantech support to obtain the current supported release and confirm whether a fix is available for this XSS issue. Track vendor advisories for an official update addressing the Create New Project User component.

Workarounds

Place the WebAccess/SCADA web interface behind a reverse proxy that enforces strict input validation and a Content Security Policy (CSP) restricting inline script execution.
Configure browsers used by operators with XSS auditors enabled and disable third-party script execution on the SCADA origin.
Limit the number of accounts authorized to access the Create New Project User functionality, reducing the attack surface for social-engineered exploitation.

bash

# Example reverse proxy CSP header to limit XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;