CVE-2026-8604: ScadaBR CSRF Vulnerability

CVE-2026-8604 Overview

CVE-2026-8604 is a Cross-Site Request Forgery (CSRF) vulnerability affecting ScadaBR version 1.2.0, an open-source Supervisory Control and Data Acquisition (SCADA) platform. The flaw allows an attacker to trigger any authenticated action by luring a logged-in user to a malicious webpage. Because ScadaBR is deployed in industrial control system (ICS) environments, exploitation can result in unauthorized changes to process configurations, data points, and user accounts. The vulnerability is tracked under CWE-352: Cross-Site Request Forgery and was disclosed in CISA ICS Advisory ICSA-26-139-03.

Critical Impact

An attacker can perform any action available to the victim's authenticated session, including modifying SCADA configurations and triggering operational changes in industrial environments.

Affected Products

• ScadaBR 1.2.0
• ScadaBR deployments using session-based authentication without CSRF tokens
• Industrial control system environments running vulnerable ScadaBR instances

Discovery Timeline

• 2026-05-19 - CVE-2026-8604 published to NVD
• 2026-05-19 - Last updated in NVD database

Technical Details for CVE-2026-8604

Vulnerability Analysis

The vulnerability resides in the web interface of ScadaBR 1.2.0. State-changing HTTP requests are processed without verifying an anti-CSRF token or comparable origin check. Any authenticated session can therefore be abused by a third-party site to submit forged requests on the user's behalf.

ScadaBR exposes administrative and operational endpoints through the same session-cookie authentication model. When an authenticated operator visits an attacker-controlled page, the browser automatically attaches session cookies to outbound requests targeting the ScadaBR server. The server cannot distinguish these forged requests from legitimate user actions.

Impact extends across confidentiality, integrity, and availability of the ScadaBR application, as reflected in the CWE-352 classification. Attackers can create privileged accounts, modify data sources, alter alarm thresholds, or change set points controlling industrial processes.

Root Cause

The root cause is the absence of CSRF protection on state-changing endpoints. ScadaBR 1.2.0 does not enforce synchronizer tokens, double-submit cookies, SameSite cookie attributes, or Origin/Referer header validation for sensitive POST and GET actions.

Attack Vector

Exploitation requires network access to a victim browser and social engineering to trigger user interaction, such as clicking a link or loading attacker-controlled content. The attacker hosts a webpage containing a hidden form or image tag that submits a request to the ScadaBR application. When the victim, already authenticated to ScadaBR, loads the page, the browser submits the forged request with valid session credentials. The exploitation pattern is described in the CISA advisory ICSA-26-139-03.

Detection Methods for CVE-2026-8604

Indicators of Compromise

• HTTP requests to ScadaBR endpoints with Referer or Origin headers pointing to external, untrusted domains
• Unexpected creation or modification of user accounts, data sources, or watchlists in ScadaBR audit logs
• Authenticated configuration changes occurring shortly after a user browsed external web content
• Spikes in POST requests to administrative endpoints originating from a single user session

Detection Strategies

• Inspect web server access logs for cross-origin Referer headers on state-changing ScadaBR URLs
• Correlate ScadaBR audit trail events with browser activity timelines for operator workstations
• Deploy a web application firewall rule to flag requests missing or mismatched Origin headers
• Alert on configuration drift in SCADA data points and user role assignments

Monitoring Recommendations

• Enable verbose logging on ScadaBR administrative endpoints and forward logs to a centralized SIEM
• Monitor operator workstation egress traffic for connections to unknown external domains preceding ScadaBR configuration events
• Track session activity for anomalies such as requests issued without prior navigation within the ScadaBR UI

How to Mitigate CVE-2026-8604

Immediate Actions Required

• Restrict ScadaBR web interface access to trusted management networks using firewall rules and VPN gateways
• Instruct operators to log out of ScadaBR sessions when not actively using the application
• Isolate operator browsing of external websites from systems with active ScadaBR sessions
• Review the CISA ICS Advisory ICSA-26-139-03 for vendor guidance and apply updates when available

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of publication. Refer to the CISA ICS Advisory ICSA-26-139-03 for the latest mitigation status and any subsequent ScadaBR release.

Workarounds

• Configure session cookies with the SameSite=Strict attribute at the reverse proxy layer to block cross-site cookie submission
• Enforce Origin and Referer header validation through a web application firewall in front of ScadaBR
• Use separate browsers or dedicated workstations for ScadaBR administration to reduce cross-site exposure
• Apply network segmentation between ICS operator workstations and general-purpose corporate networks

# Configuration example: enforce Origin header validation in nginx reverse proxy
map $http_origin $allowed_origin {
    default                          0;
    "https://scadabr.internal.local" 1;
}

server {
    listen 443 ssl;
    server_name scadabr.internal.local;

    location / {
        if ($request_method = POST) {
            set $check "${allowed_origin}";
            if ($check = 0) { return 403; }
        }
        proxy_pass http://scadabr_backend;
        proxy_cookie_flags ~ Secure SameSite=Strict;
    }
}