CVE Watch—

CVE-2021-26828

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

CVSS

—

No CVSS

EPSS

39.4%

p99

KEV

YES

Dec 3, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

39.4%EPSS · 30 days39.4%

2026-09-172026-10-15

KEV catalog record

Product

OpenPLC / ScadaBR

Vulnerability

OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Added to KEV

Dec 3, 2025

Remediate by

Dec 24, 2025

Known ransomware use

Summary description

OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/SCADA-LTS/Scada-LTS/pull/2174 ; https://nvd.nist.gov/vuln/detail/CVE-2021-26828

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2021-26829—

98.8%

KEV—80OpenPLC ScadaBR Cross-site Scripting Vulnerability—