EUVD-2026-80827

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 suffers from an Authorization Bypass in its DWR (Direct Web Remoting) component. Spring Security restricts DWR endpoints by URL path pattern , but DWR actually dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName . Addi...