U.S. CISA adds an OpenPLC ScadaBR flaw to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a cross-site scripting (XSS) vulnerability, tracked as CVE-2021-26829, to its Known Exploited Vulnerabilities catalog. This flaw affects OpenPLC ScadaBR versions 1.12.4 on Windows and 0.9.1 on Linux, with a CVSS score of 5.4. In September 2025, the pro-Russian hacktivist group TwoNet exploited this vulnerability to attack an ICS/OT honeypot, defacing the HMI login page.

CISA has mandated federal agencies to address this vulnerability by December 19, 2025, and recommends that private organizations also review and mitigate the vulnerabilities listed in the catalog.