OPC UA LDS installer flaw lets local attackers hijack high-privilege sessions
The fix is a reissued installer, not a patch, updating means scheduling a maintenance window and re-running the deployment, not pushing a binary swap.
TL;DR
CISA published an advisory for CVE-2026-77477, a privilege-escalation vulnerability in OPCFoundation OPC UA LocalDiscoveryServer installers prior to version 1.04.420. A local attacker with keyboard and display access during installation can intercept a high-privilege console window and run arbitrary commands. Affected sectors include chemical, energy, water, food and agriculture, and critical manufacturing. OPCFoundation recommends updating to the 1.04.420 installer. The vulnerability carries a CVSS 3.1 score of 4.6, low severity on paper, but the LDS ships inside SIMATIC NET PC Software, WinCC, PCS 7, and a long tail of industrial products where installers may have been run once and forgotten.
This isn't the first CISA advisory for OPCFoundation's Local Discovery Server, and the pattern is worth noting. It's the third distinct CVE in the LDS to draw an ICS advisory in recent years, following CVE-2022-44725 (hard-coded file path, CVSS 7.8) and CVE-2021-40142 (remote DoS via buffer overread, CVSS 7.5). The LDS is a discovery mechanism that helps OPC UA clients find servers on the network, it's often present even when nobody's thinking about it.
The mechanics of CVE-2026-77477 are straightforward: during installation, the LDS installer launches a high-privilege console window. An attacker who can launch the installer with elevated privileges and has local access to the keyboard and display can intercept that window and execute arbitrary commands. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects the local-access requirement and the user-interaction precondition, the attacker needs to be at the console during installation.
That's also why the score is 4.6. But the operational picture is more nuanced. The LDS doesn't ship as a standalone product that OT teams consciously track; it's bundled inside Siemens' SIMATIC NET PC Software, WinCC, PCS 7, TeleControl Server Basic, and other industrial software packages. Organizations that deployed those products years ago may not know which installer version they ran or whether the LDS component is even present. And the fix isn't a patch to an already-installed binary, OPCFoundation reissued the installer. Updating means re-running it, which means scheduling a maintenance window in an OT environment where windows are scarce.
The organizations that need to move fastest are those running older LDS installers on systems where untrusted users have local access. That configuration is rarer in well-segmented OT environments but not unheard of, particularly in multi-vendor staging areas or engineering workstations shared across shifts. Lukas Schumaker of Rockwell Automation reported the vulnerability to OPCFoundation. No known public exploitation has been reported to CISA at this time.
Published ·Deep Fathom