Is CVE-2021-26829 actively exploited?

Yes. CVE-2021-26829 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-26829 be exploited remotely?

The attack vector of CVE-2021-26829 has not been classified yet.

What is the CVSS score of CVE-2021-26829?

CVE-2021-26829 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-26829

HIGHCISA KEVIN THE WILD

CVE-2021-26829

Published: November 28, 2025

EPSS:13.57%probability of exploitation in 30 daysPercentile:94.1th

Official Description

OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

NVD Source

CISA KEV Advisory

OpenPLC ScadaBR Cross-site Scripting Vulnerability

OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.

Added to KEV: 2025-11-28Federal patch deadline: 2025-12-19

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This high-severity cross-site scripting (XSS) vulnerability in OpenPLC ScadaBR, specifically via system_settings.shtm, could allow attackers to inject malicious scripts. The high EPSS score of 0.13570 indicates a significant likelihood of exploitation, making this an urgent concern. This vulnerability is confirmed to be actively exploited in the wild.

Active exploitation of this XSS vulnerability has been observed in the wild, and it is included in CISA's KEV catalog. This indicates a critical and immediate threat, as XSS can lead to session hijacking or data theft.

Recommended Action

Apply available security updates for OpenPLC ScadaBR to address the cross-site scripting vulnerability. Implement robust input validation and output encoding for all user-supplied data.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-26829 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-26829 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.