OpenPLC ScadaBR Arbitrary JSP File Upload (CVE-2021-26828)

Historical catalog analysis: CISA added this entry on December 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2021-26828 is an unrestricted file upload vulnerability (CWE-434) identified in OpenPLC ScadaBR. The flaw allows a remote authenticated user to upload and execute arbitrary JavaServer Pages (JSP) files. This occurs specifically through the view_edit.shtm entry point, potentially allowing for remote code execution on the host system.

Exposure and applicability

This vulnerability affects environments deploying OpenPLC ScadaBR. Because this may involve an open-source component or third-party library, exposure could extend to other proprietary implementations or products that integrate the affected ScadaBR functionality.

Infrastructure owners should identify all instances of ScadaBR within their ICS/SCADA environment. The primary risk factor is the presence of authenticated accounts with access to the view_edit.shtm page; however, any compromised credential with sufficient privileges could be leveraged to exploit this path.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities (KEV) catalog, remediation should be prioritized for assets exposed to untrusted networks or those managing critical industrial processes. Our analysis suggests the following priority sequence:

1. Vendor Mitigation: Apply official patches or mitigations provided by the vendor to address the unrestricted upload mechanism.
2. Access Restriction: Limit access to the ScadaBR management interface to a restricted administrative VLAN or VPN, reducing the number of authenticated users capable of reaching view_edit.shtm.
3. Decommissioning: If no viable mitigation is available for the specific version in use, discontinue the use of the product as suggested by CISA guidance.

How to validate remediation

Verification must go beyond a simple version check, as the vulnerability may exist in various implementations of the underlying component. To verify that exposure has been reduced, defenders should:

• Functional Testing: In a staged environment, attempt to upload a non-malicious JSP file via view_edit.shtm using an authenticated account to confirm the system now rejects dangerous file types.
• Configuration Audit: Verify that network-level controls (e.g., ACLs or firewalls) successfully block unauthorized access to the management interface.

Confirmation of a successful patch is only achieved when the specific upload path no longer permits the execution of uploaded JSP files.

Limits and open questions

There are several unknowns regarding this vulnerability. While it is listed as known exploited, the source does not specify if it has been utilized in ransomware campaigns. Additionally, because ScadaBR is an open-source component, the full list of third-party products incorporating this specific vulnerable code remains undetermined. Residual risk persists if administrative credentials are compromised or if compensating network controls are bypassed.

Source and editorial note

CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability · Source date: December 03, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: December 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 27, 2026 at 00:22 UTC.

Request a Vulnerability Assessment