BaseFortify

Publication date: 2026-09-16

Last updated on: 2026-09-18

Assigner: Tenable Network Security, Inc.

Description

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-16

Last Modified

2026-09-18

Generated

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-84858

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-84858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70