Authenticated Blind SQL Injection in ScadaLTS by ScadaLTS Inc.

CVE-2026-84859

What is CVE-2026-84859?

ScadaLTS version 2.8.1-release-candidate build 0 contains an authenticated blind SQL injection vulnerability affecting the /api/events/search endpoint. The endpoint accepts a JSON body with a sortBy array, where the values are directly concatenated into the SQL ORDER BY clause without proper sanitization or parameterization. This oversight permits authenticated users, particularly those assigned the ROLE_USER role, to execute both time-based and boolean-based blind SQL injections, potentially allowing unauthorized access to sensitive database information, including user password hashes. The vulnerability remains accessible to all authenticated users across various roles, heightening the risk of data breaches.

References