CVE-2026-34185

HIGH 8.8CVE-2026-34185 · Published 09/04/2026 · updated 26/10/2026

In short

CVE-2026-34185 is a HIGH (CVSS 8.8) vulnerability affecting control system (hydrosystem.poznan).
Chance of exploitation in the next 30 days (EPSS): 0.29%, higher than 21.6% of all vulnerabilities.
Fix: update to 9.8.5 or later.

Package	Affected versions	Patched versions
control system hydrosystem.poznan	`< 9.8.5`	`9.8.5`

Description

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5

References

cert.pl/posts/2026/04/CVE-2026-4901 · Vendor Advisory
control-system.pl

More vulnerabilities in control system

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free