---
title: CISA Adds Critical Industrial Control System Vulnerability to Active Threat List
description: CISA alerts on critical XSS flaw in OpenPLC ScadaBR, urging immediate patching to prevent session hijacking and credential theft.
canonical_url: https://codekeeper.co/ticker/cisa-warns-openplc-scadabr-xss-vulnerability
---

# CISA Adds Critical Industrial Control System Vulnerability to Active Threat List

CISA alerts on critical XSS flaw in OpenPLC ScadaBR, urging immediate patching to prevent session hijacking and credential theft.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 30, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA added a critical cross-site scripting vulnerability in OpenPLC ScadaBR to its Known Exploited Vulnerabilities catalog on November 28, 2025, confirming attackers are actively using it. The flaw (CVE-2021-26829) allows remote attackers to inject malicious scripts through the system settings interface, potentially letting them hijack user sessions, steal credentials, or modify critical SCADA configurations. The vulnerability targets industrial control systems widely used in automation research and implementation. Federal agencies must patch by December 19, 2025. CISA recommends immediately applying vendor patches, reviewing third-party usage, or discontinuing the product if fixes aren't available. **Source:** [Cybersecurity News](https://cybersecuritynews.com/cisa-openplc-scadabr-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-warns-openplc-scadabr-xss-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[North Korea Used Obscure npm Package as a Dress Rehearsal Before the Axios Hack Aug 11, 2026](https://codekeeper.co/ticker/north-korean-hackers-target-npm-packages)

[Software security Five Alleged Black Axe Members Extradited to Face US Charges Sep 15, 2026](https://codekeeper.co/ticker/black-axe-leaders-extradited-romance-scams)

[Cyberattacks Ceva Logistics Cyberattack Disrupts European Operations, Exposes Customer Data Aug 26, 2026](https://codekeeper.co/ticker/ceva-logistics-cyberattack-disrupts-operations)

[APT Group 'Armored Likho' Hits Power Grids with New AI-Assisted Malware Aug 12, 2026](https://codekeeper.co/ticker/armored-likho-targets-critical-infrastructure)