ACTIVELY EXPLOITED

CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability

Facts
Vendor	OpenPLC
Product	ScadaBR
Actively exploited	Yes
Added to CISA KEV	28 Nov 2025
CISA federal deadline	19 Dec 2025
Weakness (CWE)	CWE-79

Required action (CISA's text)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description (NVD)

OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

SOURCES

CISA KEVCISA Known Exploited Vulnerabilities catalog

Other OpenPLC flaws

CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability

Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.