CVE-2026-115803: Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
Affected Software
Event History
Frequently Asked Questions
Which deployments are known to be affected?
The affected product and version identified in the available information is Scada-LTS 2.8.0. The issue is in the AmCharts Data API component, specifically AmChartValuesAPI.java.
What does an attacker need to exploit this issue?
The attack can be performed remotely by manipulating the ids request argument. The supplied information does not state that user interaction is required, but the severity vector indicates low privileges are required.
Is public exploit code available?
Yes. The available information states that an exploit has been published and may be used.
Is a vendor fix available?
The vendor stated that it was working on a new release with security enhancements to be introduced soon. No fixed version or immediate mitigation is provided in the available information.