CVE-2026-19657 is a CWE-79 reflected cross-site scripting vulnerability in ScadaLTS 2.7.8.1. The product reflects user-supplied input into HTML responses without neutralizing potentially malicious scripts. An attacker can exploit this by crafting a URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking or data manipulation within the victim's session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session, impacting confidentiality and integrity of the victim's interactions with the application. There is no impact on availability. This could lead to theft of session tokens or unauthorized actions performed on behalf of the victim.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. In the meantime, consider implementing web application firewalls or input validation controls to mitigate exploitation risk. Avoid clicking on suspicious links that could exploit this vulnerability.