CVE-2026-22553

CriticalRCE

Published: 24 February 2026

Published

24 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0143 69.6th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-22553 is a critical-severity OS Command Injection (CWE-78) vulnerability in Insat Masterscada. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

All versions of InSAT MasterSCADA BUK-TS are affected by CVE-2026-22553, a high-severity OS command injection vulnerability (CWE-78) in a field of its MMadmServ web interface. Published on 2026-02-24, this flaw carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical risk due to its potential for remote code execution.

The vulnerability can be exploited over the network by unauthenticated attackers with no privileges or user interaction required. By sending crafted input to the vulnerable endpoint in the MMadmServ web interface, malicious users can inject operating system commands, achieving arbitrary remote code execution with high impact on confidentiality, integrity, and availability.

Mitigation details are outlined in CISA ICS Advisory ICSA-26-055-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-01 and the corresponding CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-01.json. Security practitioners should consult these resources for recommended patches, workarounds, or configuration changes specific to InSAT MasterSCADA BUK-TS.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-8564

Vulnerability details

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Unauthenticated OS command injection in public-facing web interface enables remote exploitation of public-facing application (T1190) and command/script execution (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0