CVE-2021-26829VulnerabilityPublished 11/28/2025Updated 10/24/2026
CVE-2021-26829: OpenPLC ScadaBR Cross-site Scripting Vulnerability
Affects OpenPLC ScadaBRSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 11/28/2025
- KEV deadline
- 12/19/2025
- EPSS
- 48.0% chance of exploitation in 30 days – higher than 98% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.