CVE-2026-8602: ScadaBR Authentication Bypass Vulnerability

CVE-2026-8602 Overview

CVE-2026-8602 is a Missing Authentication for Critical Function vulnerability [CWE-306] in ScadaBR version 1.2.0. The flaw allows an unauthenticated attacker to send crafted HTTP GET requests to the Supervisory Control and Data Acquisition (SCADA) system and inject arbitrary sensor readings. CISA published the issue in ICS Advisory ICSA-26-139-03. ScadaBR is an open-source SCADA platform used in industrial control system (ICS) deployments, where falsified telemetry can influence operator decisions and automated control logic.

Critical Impact

Unauthenticated network attackers can inject arbitrary sensor readings into ScadaBR, corrupting industrial telemetry and undermining the integrity of control decisions.

Affected Products

• ScadaBR version 1.2.0
• Deployments exposing the ScadaBR HTTP interface to untrusted networks
• Industrial control environments relying on ScadaBR for sensor data acquisition

Discovery Timeline

• 2026-05-19 - CVE-2026-8602 published to the National Vulnerability Database (NVD)
• 2026-05-19 - CISA publishes ICS Advisory ICSA-26-139-03
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8602

Vulnerability Analysis

The vulnerability stems from the absence of authentication on an HTTP endpoint that accepts sensor data writes. Because the endpoint performs no identity or session validation, any client that can reach the ScadaBR HTTP listener can submit values. The attack requires only a network path to the target and a simple HTTP GET request. There is no requirement for user interaction, credentials, or prior knowledge of the deployment.

The integrity impact is high: injected values flow into the SCADA historian and runtime data points. Downstream alarms, dashboards, automation scripts, and operator displays consume these values as ground truth. Availability of the control process can also degrade when fabricated readings trigger automated responses such as shutdowns or setpoint changes. Confidentiality is not directly affected by this flaw.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. The sensor write functionality is exposed without enforcing authentication or authorization, violating the principle that state-changing operations on industrial data must require a verified identity. The use of HTTP GET for a write operation further compounds the issue, as GET requests are easily replayed, logged, and triggered from third-party contexts.

Attack Vector

An attacker reaches the ScadaBR HTTP service over the network and issues a GET request containing the target data point identifier and the desired value. ScadaBR accepts the request, writes the value to the corresponding sensor channel, and propagates it through the SCADA pipeline. No authentication header, session cookie, or token is validated. Refer to the CISA ICS Advisory ICSA-26-139-03 for endpoint-specific details.

Detection Methods for CVE-2026-8602

Indicators of Compromise

• Unauthenticated HTTP GET requests to ScadaBR sensor or data point write endpoints originating from unexpected source addresses
• Sudden, statistically improbable changes in sensor values that do not correlate with physical process state
• Web server access logs showing high-frequency GET requests targeting data point identifiers
• Alarm events triggered by values that fall outside historical operating ranges without corresponding process events

Detection Strategies

• Monitor ScadaBR HTTP access logs for requests to sensor update paths that lack authenticated session context
• Correlate sensor value changes with operator activity and SCADA write commands to identify out-of-band writes
• Deploy network intrusion detection signatures for HTTP GET patterns targeting ScadaBR endpoints from non-engineering subnets

Monitoring Recommendations

• Forward ScadaBR application and web server logs to a centralized log platform with retention sufficient for ICS incident review
• Establish baselines for each data point and alert on deviations that exceed expected physical tolerances
• Track all external connections to the ScadaBR host and alert on any source outside the authorized OT management network

How to Mitigate CVE-2026-8602

Immediate Actions Required

• Remove direct network exposure of ScadaBR 1.2.0 from any untrusted or corporate network segment
• Place ScadaBR behind a reverse proxy or VPN that enforces authentication before traffic reaches the application
• Restrict inbound access to the ScadaBR HTTP port using host-based and network firewalls, allowing only known engineering workstations
• Review historian data for anomalous values written during periods when the system may have been reachable from unauthorized sources

Patch Information

No vendor patch is referenced in the NVD entry or the CISA advisory at the time of publication. Operators should consult the CISA ICS Advisory ICSA-26-139-03 for the latest vendor guidance and apply any future fixed release for ScadaBR as soon as it becomes available.

Workarounds

• Segment ScadaBR into an isolated OT network following ISA/IEC 62443 zone and conduit guidance
• Require VPN access with multi-factor authentication for any remote interaction with the SCADA host
• Disable or block the affected HTTP endpoints at a reverse proxy if they are not required for operations
• Implement strict allowlists at the perimeter to permit only authorized engineering source addresses

# Example: restrict inbound access to ScadaBR HTTP port using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP