CVE-2026-34184
Missing Authorization inAlanWeb SCADA
- State
- Published
- Severity
- 8.8 High
- Published
- Apr 9, 2026
- Updated
- Aug 13, 2026
- Reserved
- Mar 26, 2026
Description
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database.
This issue was fixed in AlanWeb SCADA version 9.8.5
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.8 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
AlanWeb SCADAControl System |
|
References
- https://cert.pl/posts/2026/04/CVE-2026-4901/third-party-advisory
- https://control-system.pl/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.