CVE entry · CVE-2021-26828
CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
- Actively exploited: added to CISA’s KEV catalog on December 3, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: December 24, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes OpenPLC ScadaBR, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.