CVE-2026-84859: ScadaLTS Authenticated Blind SQL Injection

CVE-2026-84859 Overview

CVE-2026-84859 is an authenticated blind SQL injection vulnerability in ScadaLTS 2.8.1-release-candidate build 0. The flaw resides in the /api/events/search endpoint, which accepts a JSON body containing a sortBy array. Values from this array are concatenated directly into the SQL ORDER BY clause without sanitization or parameterization. Authenticated users holding ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC can exploit the flaw to perform time-based and boolean-based blind SQL injection. Attackers can extract arbitrary database contents, including password hashes for all users.

Critical Impact
Any authenticated ScadaLTS user can exfiltrate database contents, including credential hashes, through the sortBy parameter of the events search API.

Affected Products

ScadaLTS 2.8.1-release-candidate build 0
/api/events/search REST endpoint
Endpoints governed by the spring-security.xml role configuration granting API access to ROLE_USER, ROLE_ADMIN, and ROLE_PUBLIC

Discovery Timeline

2026-09-16 - CVE-2026-84859 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84859

Vulnerability Analysis

The vulnerable endpoint accepts a POST request with a JSON body that contains a sortBy array. ScadaLTS appends each array value directly into the generated SQL ORDER BY clause. Because the values bypass both input validation and parameterized queries, attacker-controlled SQL fragments execute against the underlying database.

The ORDER BY context does not return data directly to the response. Attackers therefore rely on blind exfiltration techniques. Time-based payloads use functions such as SLEEP() or conditional CASE expressions to induce measurable response delays. Boolean-based payloads infer data one bit at a time by triggering different response states.

The endpoint is exposed to low-privilege accounts, so any user with ROLE_USER can trigger the injection. In supervisory control environments, this typically includes operators, contractors, and integration accounts.

Root Cause

The root cause is unsafe string concatenation of user-controlled JSON input into a SQL statement. The sortBy handler treats each element as trusted column-order syntax rather than untrusted input. There is no allowlist of sortable columns, no type validation, and no use of prepared statements for the ordering clause. This is a classic SQL Injection weakness [CWE-89].

Attack Vector

An authenticated attacker sends a POST /api/events/search request with a crafted JSON body. The sortBy array carries the SQL payload. Because the injection point is ORDER BY, the attacker uses subselects or conditional sleep expressions to observe database behavior over multiple requests. Repeated requests extract characters of sensitive fields, including hashed user credentials from the users table, enabling offline password cracking and follow-on lateral movement.

See the Tenable Security Research advisory for endpoint and payload details.

Detection Methods for CVE-2026-84859

Indicators of Compromise

Repeated POST /api/events/search requests from a single authenticated session within a short window
Request bodies where the sortBy field contains SQL keywords such as SELECT, CASE, SLEEP, BENCHMARK, UNION, or --
Response latency spikes on /api/events/search consistent with time-based injection payloads
Unusual database CPU or query duration correlated with events API traffic

Detection Strategies

Inspect application and reverse proxy logs for JSON bodies posted to /api/events/search containing non-alphanumeric characters in sortBy values
Alert on ScadaLTS API sessions issuing high-volume search requests with identical structure and varying payloads
Enable database query logging and flag ORDER BY clauses that contain subqueries, conditional expressions, or timing functions

Monitoring Recommendations

Baseline normal sortBy values and alert on any value that is not in the expected column allowlist
Correlate authenticated ScadaLTS user activity with database wait time and error rate metrics
Forward web, application, and database logs to a centralized analytics platform for cross-source correlation

How to Mitigate CVE-2026-84859

Immediate Actions Required

Restrict network access to the ScadaLTS management interface to trusted operator networks only
Audit user accounts holding ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC and remove unnecessary access
Rotate all ScadaLTS user passwords and any credentials that share the same hashes elsewhere
Deploy a web application firewall rule that blocks SQL metacharacters in the sortBy JSON field

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Monitor the ScadaLTS project releases and the Tenable advisory for a fixed build. Until a fix is available, apply the workarounds below.

Workarounds

Block or rewrite requests to /api/events/search at an upstream proxy when sortBy contains characters outside [A-Za-z0-9_]
Disable API access for accounts that do not require the events search functionality
Enforce database-level least privilege so the ScadaLTS service account cannot read sensitive tables beyond what the application requires

bash

# Example NGINX rule to reject suspicious sortBy payloads
location /api/events/search {
    if ($request_body ~* "(select|sleep|benchmark|union|case\s+when|--|/\*)") {
        return 403;
    }
    proxy_pass http://scadalts_backend;
}