CVE-2026-8153 is an OS command injection vulnerability in the Dashboard Server component of Universal Robots PolyScope 5, an OS and GUI for controlling collaborative industrial robots. The Dashboard Server accepts user input without proper sanitization, allowing unauthenticated remote attackers with network access to execute arbitrary OS commands. This leads to remote code execution and full compromise of the robot controller. Exploitation requires the Dashboard Server to be enabled and accessible on the network. The vulnerability has a CVSS score of 9.8 and has been patched in PolyScope 5.25.1. The attack surface is primarily internal networks, as robots are not designed for direct Internet exposure. However, flat network architectures and enabled Ethernet ports on control boxes increase risk. The impact ranges from control of a single cobot to compromise of entire fleets and connected OT equipment.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the robot controller, leading to full compromise of the device. This impacts confidentiality, integrity, and availability of the robot and potentially connected operational technology systems. The vulnerability could enable attackers to control individual cobots, posing safety hazards, or escalate to compromise entire fleets and associated peripherals. The risk is heightened in flat, unsegmented internal networks where attackers may gain initial footholds. Direct Internet exploitation is unlikely due to typical firewall protections and design constraints.

A patch addressing CVE-2026-8153 is available in Universal Robots PolyScope version 5.25.1. Organizations using affected versions should apply this official update promptly. The vendor advisory and CISA confirm the patch availability and recommend enabling the Dashboard Server only when necessary. Since direct Internet exposure is uncommon and typically blocked by firewalls, maintaining network segmentation and restricting access to the Dashboard Server port reduces risk. No additional mitigations are required beyond applying the patch and following vendor guidance.