CVE-2026-84860: ScadaLTS Authorization Bypass Vulnerability

CVE-2026-84860 Overview

CVE-2026-84860 is an authorization bypass vulnerability in ScadaLTS 2.8.1-release-candidate build 0. The flaw stems from a mismatch between how Spring Security enforces access control and how Direct Web Remoting (DWR) dispatches method calls. Spring Security gates DWR endpoints by URL path pattern, while DWR itself routes calls based on the c0-scriptName and c0-methodName parameters in the POST body. Because the crossDomainSessionSecurity setting in web.xml is disabled, DWR's built-in origin validation is off. An authenticated low-privilege user can invoke any DWR method on any restricted class by posting to a URL they are already permitted to reach.

Critical Impact

Authenticated attackers with low privileges can invoke restricted DWR methods, breaking the application's access control model and enabling further exploitation chains.

Affected Products

• ScadaLTS 2.8.1-release-candidate build 0

Discovery Timeline

• 2026-09-16 - CVE-2026-84860 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84860

Vulnerability Analysis

ScadaLTS exposes server-side Java methods to browsers through DWR, a remoting framework that dispatches calls based on POST body parameters. The application relies on Spring Security to restrict which DWR URLs a user may reach. However, once a request arrives at any allowed DWR endpoint, the DWR servlet uses the body-supplied c0-scriptName and c0-methodName to select which class and method to execute.

This creates a gap: URL-based rules never inspect the body, and the body-based dispatcher never consults the URL rules. An attacker authenticated with the lowest privilege can send a POST to a public endpoint such as MiscDwr.initializeLongPoll.dwr while specifying a restricted class name in the body. The DWR framework then invokes the restricted method under the attacker's session.

Root Cause

The root cause is a broken access control pattern combined with an insecure configuration. Spring Security enforces authorization at the URL layer, but DWR routes execution based on request-body identifiers. Setting crossDomainSessionSecurity to false in web.xml removes DWR's own session token check, eliminating the last barrier against arbitrary method invocation.

Attack Vector

Exploitation requires an authenticated session with any valid ScadaLTS account. The attacker sends a POST request to a DWR URL that Spring Security permits for their role. The request body sets c0-scriptName to a restricted class and c0-methodName to a sensitive method. The server dispatches the call without re-checking role permissions against the target class, giving the attacker access to functionality reserved for higher privilege tiers.

No verified public exploit code is available. Refer to the Tenable Research Advisory TRA-2026-60 for full technical details.

Detection Methods for CVE-2026-84860

Indicators of Compromise

• POST requests to .dwr endpoints where the c0-scriptName body value does not match the class implied by the URL path.
• DWR invocations of administrative or restricted classes originating from sessions belonging to low-privilege users.
• Repeated POSTs to MiscDwr.initializeLongPoll.dwr or similar public DWR endpoints containing varying c0-scriptName values.

Detection Strategies

• Parse DWR request bodies at the web proxy or WAF and compare c0-scriptName against the URL path segment for consistency.
• Correlate authenticated user roles with the DWR classes and methods they invoke, flagging any invocation outside the user's assigned privilege set.
• Enable verbose DWR access logging and alert on invocations of security-sensitive classes by non-administrative accounts.

Monitoring Recommendations

• Forward ScadaLTS application logs and reverse-proxy access logs to a centralized analytics platform for role-versus-method baselining.
• Alert on any spike in 200-response DWR calls following authentication events from newly created or rarely used accounts.
• Track configuration drift on web.xml, specifically the crossDomainSessionSecurity parameter, to detect regressions.

How to Mitigate CVE-2026-84860

Immediate Actions Required

• Restrict network access to the ScadaLTS management interface to trusted operator networks and VPN users only.
• Audit ScadaLTS accounts and remove or disable any unused low-privilege accounts that could be used to establish an authenticated session.
• Review web server and application logs for evidence of DWR method invocations by accounts that should not have access to those classes.

Patch Information

No vendor patch has been referenced in the NVD entry at publication time. Monitor the ScadaLTS project and the Tenable Research Advisory TRA-2026-60 for updated fix guidance and upgrade to a corrected release once available.

Workarounds

• Set crossDomainSessionSecurity to true in web.xml to re-enable DWR's built-in session token validation for cross-origin protection.
• Apply defense-in-depth by inserting a reverse proxy rule that blocks POST bodies whose c0-scriptName value references restricted DWR classes.
• Enforce strict role-based filters at a web application firewall that inspect DWR body parameters, not just URL paths.

# Configuration example: re-enable DWR cross-domain session security in web.xml
# <init-param>
#   <param-name>crossDomainSessionSecurity</param-name>
#   <param-value>true</param-value>
# </init-param>