Universal Robots PolyScope Critical OS Command Injection (CVE-2026-8153)
A critical OS command injection vulnerability, tracked as CVE-2026-8153, has been identified in the Dashboard Server interface of Universal Robots PolyScope versions prior to 5.21.1. According to the National Vulnerability Database, this flaw allows an unauthenticated attacker to craft commands that execute arbitrary code on the robot’s operating system. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a severe risk.
The attacker’s calculus here is straightforward: full control over industrial robotic systems. This isn’t just about data exfiltration; it’s about kinetic impact. An unauthenticated attacker gaining OS-level access to a robot can disrupt manufacturing lines, sabotage products, or even create dangerous physical situations. The lack of authentication required makes this an extremely attractive target for adversaries seeking high-impact industrial control system (ICS) compromise.
Defenders with Universal Robots deployments must prioritize patching immediately. Given the critical CVSS score and the unauthenticated nature of the exploit, these systems are highly exposed if not updated. This isn’t a vulnerability to defer; it’s a direct path to operational shutdown or worse.
What This Means For You
- If your organization uses Universal Robots PolyScope, specifically versions prior to 5.21.1, you are exposed to unauthenticated OS command injection. Patch these systems immediately to version 5.21.1 or later. Audit network access to your robot control systems and ensure the Dashboard Server interface is not unnecessarily exposed to untrusted networks.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-8153 - Universal Robots PolyScope OS Command Injection via Dashboard Server
title: CVE-2026-8153 - Universal Robots PolyScope OS Command Injection via Dashboard Server
id: scw-2026-05-08-ai-1
status: experimental
level: critical
description: |
Detects attempts to exploit CVE-2026-8153 by targeting the Dashboard Server interface in Universal Robots PolyScope. The rule looks for specific URI paths and query parameters commonly used in exploit attempts to achieve OS command injection, specifically by attempting to access sensitive files like /etc/passwd.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-8153/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/dashboard/api/users/users/export'
cs-uri-query|contains:
- '..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-8153 | Command Injection | Universal Robots PolyScope versions prior to 5.21.1 |
| CVE-2026-8153 | Command Injection | OS command injection in Dashboard Server interface |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 15:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...