CISA flags OPC UA LDS installer flaw, urges update to 1.04.420

By Atlas Watchline Staff · Regulatory · September 3, 2026

CISA said the issue affects OPCFoundation UA-LDS-Installers earlier than version 1.04.420 and could let a local attacker run arbitrary commands during installation.

CISA on Sept. 3, 2026, issued an industrial control systems advisory for a vulnerability in OPCFoundation’s OPC UA LocalDiscoveryServer installers that could let an attacker take over a high-privilege terminal during installation and run arbitrary commands.

The agency said the flaw, tracked as CVE-2026-77477, affects UA-LDS-Installers versions earlier than 1.04.420. CISA classified the issue as medium severity under CVSS v3.1, with a base score of 4.6, and said it is not exploitable remotely.

CISA said the product is deployed worldwide and is associated with critical infrastructure sectors including chemical, energy, food and agriculture, water and wastewater, and critical manufacturing. Successful exploitation requires the attacker to be able to launch an installer with elevated privileges and have keyboard and display access while installation is in progress.

CISA mapped the flaw to CWE-250, or execution with unnecessary privileges. Under CVSS v4.0, the agency listed the issue as low severity with a base score of 2.4.

The advisory said no known public exploitation specifically targeting the vulnerability has been reported to CISA at this time. It also said the vulnerability was reported to OPCFoundation by Lukas Schumaker of Rockwell Automation.

CISA recommended updating to OPC UA LDS Installers 1.04.420 or later. The advisory points readers to the OPCFoundation security advisory in GitHub for more information.

Sources

• CISA ICS advisory ICSA-26-246-01

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.