CVE-2021-26829

OpenPLC — OpenPLC ScadaBR Cross-site Scripting Vulnerability

CISA KEV · in the CISA KEV catalog since 2025-11-28

What EVULNABLE says

EVULNABLE Risk · priority 75/100 Urgent Raised to the floor for a confirmed exploited vulnerability. Intelligence coverage 75/90 — no pre-patch disclosure data

Overdue by 8 monthsCISA KEVActively Exploited

Why it matters: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.

The priority band answers “how soon”, not “how bad” — see Methodology for what it weighs and where it abstains.

The evidence behind it

Published measurements for CVE-2021-26829
Measure	Value	Source
CVSS base score	5.4	NVD
FIRST EPSS	0.480 (98.8th pctl)	FIRST
Actively exploited	Confirmed	CISA KEV
Ransomware campaign use	Unknown or none	CISA KEV
CISA remediation deadline	2025-12-19 — Overdue by 8 months	CISA KEV

Intelligence coverage 75/90 — no pre-patch disclosure data

What CISA says to do

The primary records

This page is an opinion about urgency. Where it and a source of record disagree, the source of record is the record.

NVD ↗ CISA KEV ↗ Vendor Advisory ↗