Historical catalog analysis: CISA added this entry on December 03, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2021-26828 is an unrestricted file upload vulnerability (CWE-434) identified in OpenPLC ScadaBR. The flaw allows a remote authenticated user to upload and execute arbitrary JavaServer Pages (JSP) files via the view_edit.shtm component. This type of vulnerability can lead to remote code execution (RCE), potentially allowing an attacker to gain unauthorized control over the system hosting the SCADA software.
Exposure and applicability
This vulnerability is applicable to healthcare organizations utilizing OpenPLC ScadaBR for building automation, facility infrastructure management, or medical environment monitoring. Because SCADA systems often interface with physical hardware—such as HVAC, power distribution, or specialized clinical environmental controls—a compromise of this software could impact the operational resilience of a medical facility and the continuity of patient care.
Organizations should determine if OpenPLC ScadaBR is deployed within their environment, either as a standalone installation or as an integrated component of a third-party infrastructure management solution.
Remediation priorities
Based on our analysis, healthcare security leaders and clinical engineering teams should prioritize the following actions to reduce risk:
- Apply Vendor Mitigations: The primary priority is to implement mitigations provided by the vendor or update the software to a version where this flaw is addressed. This directly targets the root cause of the unrestricted upload.
- Restrict Administrative Access: Since the vulnerability requires authentication, limiting access to the ScadaBR management interface to a small number of authorized personnel via strict network segmentation (e.g., placing the interface on a dedicated management VLAN) could reduce the likelihood of exploitation.
- Evaluate Product Viability: In cases where mitigations are unavailable or cannot be safely applied to critical infrastructure, organizations should evaluate whether to discontinue use of the product in favor of a more secure alternative.
How to validate remediation
To verify that exposure has been reduced, administrators can perform the following checks:
* Version Verification: Confirm that the installed version of OpenPLC ScadaBR matches the patched or mitigated version specified by the vendor.
* Access Control Audit: Review firewall and ACL logs to ensure that only authorized administrative IPs can reach the view_edit.shtm endpoint.
* Configuration Review: Verify that authentication requirements are strictly enforced for all file upload functions within the application.
Limits and open questions
It remains unknown whether this vulnerability has been leveraged in active ransomware campaigns. Additionally, because ScadaBR is an open-source component, it may be embedded in various proprietary third-party products; healthcare providers may need to contact their infrastructure vendors to determine if these third-party tools are affected by CVE-2021-26828.
Applying updates to SCADA systems can occasionally impact the stability of facility controls. All remediation steps should be coordinated with clinical engineering and performed in accordance with vendor guidance to avoid disrupting patient care environments.
Source and editorial note
CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability · Source date: December 03, 2025 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: December 06, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 24, 2026 at 01:00 UTC.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗