Cyber Posture

CVE-2026-22553

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
27 February 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0128 79.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the specific OS command injection flaw in the MMadmServ web interface via timely patching or vendor-recommended workarounds.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes inputs to the vulnerable field in the MMadmServ web interface to prevent OS command injection attacks.

SC-7 Boundary Protection partial match
prevent

Monitors and controls network traffic to the MMadmServ web interface, blocking unauthenticated remote access and exploitation attempts.

Security SummaryAI

All versions of InSAT MasterSCADA BUK-TS are affected by CVE-2026-22553, a high-severity OS command injection vulnerability (CWE-78) in a field of its MMadmServ web interface. Published on 2026-02-24, this flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical risk due to its potential for remote code execution.

The vulnerability can be exploited over the network by unauthenticated attackers with no privileges or user interaction required. By sending crafted input to the vulnerable endpoint in the MMadmServ web interface, malicious users can inject operating system commands, achieving arbitrary remote code execution with high impact on confidentiality, integrity, and availability.

Mitigation details are outlined in CISA ICS Advisory ICSA-26-055-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01 and the corresponding CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-01.json. Security practitioners should consult these resources for recommended patches, workarounds, or configuration changes specific to InSAT MasterSCADA BUK-TS.

Details

CWE(s)
CWE-78

Affected Products

insat
masterscada
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

Unauthenticated OS command injection in public-facing web interface enables remote exploitation of public-facing application (T1190) and command/script execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References