OPCFoundation OPC UA LocalDiscoveryServer (LDS)
CISA warns CVE-2026-77477 (CVSS 4.6) lets local attackers hijack a privileged console during OPC UA LDS installation below version 1.04.420.
CISA published ICSA-26-246-01 for CVE-2026-77477, CWE-250 execution with unnecessary privileges in OPC Foundation UA-LDS-Installers below 1.04.420. An attacker able to launch the installer with elevated privileges and access the keyboard and display can intercept a high-privilege console window during installation and run arbitrary commands. CVSS 3.1 score is 4.6, the issue is not remotely exploitable, and no public exploitation has been reported. Lukas Schumaker of Rockwell Automation reported the flaw to OPC Foundation.
- CVE-2026-77477 is a CWE-250 privilege issue in UA-LDS-Installers below 1.04.420
- Attack requires elevated installer launch plus physical access to keyboard and display
- Not remotely exploitable and no exploitation reported to CISA
- CVSS 3.1 score is 4.6; affects critical infrastructure users of OPC UA LDS
- CVEs
- CVE-2026-77477
- Vendors
- OPCFoundation
- Organizations
- CISARockwell Automation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-77477 | — | — | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands. The following versions of OPCFoundation OPC UA LocalDiscoveryServer (LDS) are affected: UA-LDS-Installers <1. 04.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.