OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2021-06-11 Published
2. 2025-11-28 Added to CISA KEV
3. 2025-12-01 CISA SSVC: exploitation active
4. 2025-12-19 CISA patch deadline

Added

11 mo ago (2025-11-28)

Patch by

2025-12-19 (10 mo ago)

Ransomware

Not known

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

OpenPLC, ScadaBR

CISA name

OpenPLC ScadaBR Cross-site Scripting Vulnerability

Exploitation

Active, exploited in the wild

Automatable

no

Technical impact

partial

Assessed

11 mo ago (2025-12-01)

48.05% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

• youtu.be https://youtu.be/Xh6LPCiLMa8 referenced PoC, tagged "exploit" by a source, unverified

Weakness

• CWE-79 Improper Neutralization of Input During Web Page Generation

• youtu.be /Xh6LPCiLMa8

  exploit, third-party-advisory

• forum.scadabr.com.br /t/report-falhas-de-seguranca-em-versoes-do-scadabr/3615/4

  vendor-advisory

• forescout.com /blog/anatomy-of-a-hacktivist-attack-russian-aligned-group-targets-otics/

  third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26829

  government-resource, us-government-resource

• CVE List CVE-2021-26829
• NVD CVE-2021-26829

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.