{"vulnerability": "cve-2026-8603", "sightings": [{"uuid": "ae31c6db-c8b4-4b96-9204-bd02bdd42880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-8603", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-03", "content": "", "creation_timestamp": "2026-05-19T05:00:00.000000Z"}, {"uuid": "45e8d79a-8e64-4e25-abc3-ec9546609d7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8603", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mma7gqdcuo2c", "content": "CVE-2026-8603 - Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR\nCVE ID : CVE-2026-8603\n \n Published : May 19, 2026, 5:03 p.m. | 1\u00a0hour, 11\u00a0minutes ago\n \n Description : In ScadaBR version 1.2.0, an OS Command Injection vulne...", "creation_timestamp": "2026-05-19T20:16:07.552782Z"}, {"uuid": "324d1983-67c2-492a-a5a0-2b33c444af95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8603", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motqi3ztlk27", "content": "\ud83d\udea8  ALERT: CVE-2026-8603\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nIn ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.\n\n\ud83c\udfaf WHO'S AFFECTED:\n  \u2022 Scadabr\n\n\u2694\ufe0f HOW IT'S EXPLOITED:\nAttack vector: unknown\nImpact: high impact on confidenti", "creation_timestamp": "2026-06-22T01:32:05.328829Z"}, {"uuid": "99635322-2f17-4118-9b6e-7fe483ac1a09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86039", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mvqbe7zmh526", "content": "CVE-2026-86039 lets @libp2p/peer-store store attacker-controlled multiaddrs as certified addresses for a victim peer ID because consumePeerRecord does not bind the signer to PeerRecord.peerId. #software", "creation_timestamp": "2026-09-17T18:19:52.220996Z"}, {"uuid": "6b68bc55-f96b-4752-932f-e523408535aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86038", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-c3gv-825q-fvmp", "content": "", "creation_timestamp": "2026-09-17T18:35:04.332658Z"}, {"uuid": "2278034d-57a7-4d4e-a0d7-d9c6132529db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86039", "type": "seen", "source": "https://gist.github.com/alon710/2a63239df5d54f7447e1b660b93edce2", "content": "# CVE-2026-86039: CVE-2026-86039: Signature Verification Bypass and Address Book Poisoning in @libp2p/peer-store\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-86039\n\n## Summary\nA logic verification vulnerability in `@libp2p/peer-store` (part of the `js-libp2p` ecosystem) allows unauthenticated remote attackers to bypass identity verification and poison a victim node's peer store database with arbitrary network multiaddresses. This occurs because `consumePeerRecord()` fails to ensure that the signature's identity matches the inner record payload's identity.\n\n## TL;DR\nThe `consumePeerRecord()` function verifies the signature of a wrapping envelope but does not validate that the signer's identity equals the peer ID specified inside the payload, allowing attackers to poison address stores of network nodes.\n\n## Technical Details\n\n- **CWE ID**: CWE-290 / CWE-345\n- **Attack Vector**: Network\n- **CVSS Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: Integrity (High), Availability (Low)\n- **Exploit Status**: None (No public PoC)\n- **KEV Status**: Not in CISA KEV\n\n## Affected Systems\n\n- js-libp2p ecosystem applications\n- libp2p-based decentralized nodes\n- @libp2p/peer-store users\n- **@libp2p/peer-store**: >= 8.0.0 < 12.0.24 (Fixed in: `12.0.24`)\n\n## Mitigation\n\n- Upgrade @libp2p/peer-store to 12.0.24 or higher\n- Implement logging and alerting on mismatch warnings\n- Disable Gossipsub PX if not strictly required in trusted environments\n\n**Remediation Steps:**\n1. Analyze the project dependency tree to locate vulnerable versions of @libp2p/peer-store (< 12.0.24).\n2. Update the manifest file (package.json) to declare @libp2p/peer-store v12.0.24 or higher.\n3. Rebuild the dependency lockfile (package-lock.json or yarn.lock) and deploy the updated application.\n4. Configure log analysis rules to monitor for the 'signing key did not match peer id' signature.\n\n## References\n\n- [GitHub Security Advisory GHSA-vrf4-mx87-p53w](https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-86039) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T19:31:30.241978Z"}, {"uuid": "a98046a5-7268-43d8-9bde-f9133a9751e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-86039", "type": "published-proof-of-concept", "source": "https://github.com/libp2p/js-libp2p/security/advisories/GHSA-vrf4-mx87-p53w", "content": "", "creation_timestamp": "2026-09-17T20:35:02.494981Z"}, {"uuid": "4cc82791-bb91-4381-9c45-048e748ce079", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86035", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mwqwvneoyi2h", "content": "[release-26.05] weblate: patch CVE-2026-86035\n\nhttps://github.com/NixOS/nixpkgs/pull/568728\n\n#security", "creation_timestamp": "2026-09-30T18:10:36.573065Z"}]}