CVE-2026-84859

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users. The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.

• CWE-89

• https://www.tenable.com/security/research/tra-2026-60

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84850Improper certificate validation in the shared HTTP client us…4.8
• CVE-2026-84851An uncontrolled recursion issue exists in Amazon Ion-C versi…7.5
• CVE-2026-84852A security vulnerability has been detected in Reader Tools P…4.4
• CVE-2026-84856A vulnerability was detected in rowboatlabs rowboat up to 0.…5.3
• CVE-2026-84857A flaw has been found in sigoden aichat up to 0.30.4. This a…5.3
• CVE-2026-84858ScadaLTS 2.8.1-release-candidate build 0 is affected by an A…8.8
• CVE-2026-8486Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-84860ScadaLTS 2.8.1-release-candidate build 0 is affected by an A…8.8
• CVE-2026-84862IBM Guardium Data Protection 12.2 is vulnerable to insecure …7.2
• CVE-2026-84869A condition in the ScreenConnect client may allow files to b…9.9
• CVE-2026-8487Incorrect default permissions vulnerability in Progress Soft…7.5
• CVE-2026-8488Allocation of resources without limits or throttling vulnera…7.5