CISA Flags Actively Exploited OpenPLC Flaw (CVE-2021-26829)

The Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to secure their industrial control systems due to active exploitation of the CVE-2021-26829 vulnerability in OpenPLC ScadaBR. This Stored Cross-Site Scripting (XSS) flaw affects specific versions of the software and allows attackers to inject malicious scripts that execute in the browser of administrators, potentially compromising operational technology environments.

CISA has set a compliance deadline of December 19, 2025, urging all organizations managing critical infrastructure to prioritize remediation to prevent disruptions.