CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body. This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.

• CWE-639

• https://www.tenable.com/security/research/tra-2026-60

Published

Sep 16, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-84852A security vulnerability has been detected in Reader Tools P…4.4
• CVE-2026-84856A vulnerability was detected in rowboatlabs rowboat up to 0.…5.3
• CVE-2026-84857A flaw has been found in sigoden aichat up to 0.30.4. This a…5.3
• CVE-2026-84858ScadaLTS 2.8.1-release-candidate build 0 is affected by an A…8.8
• CVE-2026-84859ScadaLTS 2.8.1-release-candidate build 0 is affected by an A…6.5
• CVE-2026-8486Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-84862IBM Guardium Data Protection 12.2 is vulnerable to insecure …7.2
• CVE-2026-84869A condition in the ScreenConnect client may allow files to b…9.9
• CVE-2026-8487Incorrect default permissions vulnerability in Progress Soft…7.5
• CVE-2026-8488Allocation of resources without limits or throttling vulnera…7.5
• CVE-2026-84882IBM Guardium Data Protection 12.2 is vulnerable to path trav…7.5
• CVE-2026-84884IBM Guardium Data Protection 12.2 stores internal REST servi…7.5