Is CVE-2026-77477 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-77477

OPCFoundation recommends users update to OPC UA LDS Installers version 1.04.420 or later. See the OPCFoundation security advisory at https://github.com/OPCFoundation/OPC-SecurityAdvisories/tree/latest/csaf/2026/009 for more information.

Quick answers

What is CVE-2026-77477?: OPCFoundation recommends users update to OPC UA LDS Installers version 1.04.420 or later. See the OPCFoundation security advisory at https://github.com/OPCFoundation/OPC-SecurityAdvisories/tree/latest/csaf/2026/009 for more information.
How severe is CVE-2026-77477?: medium, CVSS 4.6
Is CVE-2026-77477 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-77477 be mitigated?: OPCFoundation recommends users update to OPC UA LDS Installers version 1.04.420 or later. See the OPCFoundation security advisory at https://github.com/OPCFoundation/OPC-SecurityAdvisories/tree/latest/csaf/2026/009 for more information.

CVSS

4.6

Vendor

OPCFoundation

Published

Sep 30, 2026 · 08:05

Patch

Unknown / not confirmed

Affected products

OPC UA LocalDiscoveryServer (LDS)

Mitigation

CISA Advises Mitigation for OPC UA LocalDiscoveryServer Installation Privilege Interception Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-77477 to its Known Exploited Vulnerabilities catalog. The vulnerability exists in OPCFoundation OPC UA LocalDiscoveryServer (LDS) Installers prior to 1.04.420. Successful exploitation could allow an attacker with local access to intercept a high-privilege console window launched during installation and execute arbitrary commands. Exploitation requires the attacker to launch an installer with elevated privileges and have access to the keyboard and display during the installation process. The vulnerability has a CVSS v3 base score of 4.6 (MEDIUM) and is not exploitable remotely. OPCFoundation recommends updating to version 1.04.420 or later.

—2m

CVE-2026-77477

Quick answers

Related News

CISA Advises Mitigation for OPC UA LocalDiscoveryServer Installation Privilege Interception Flaw