A Low-Scoring Advisory Worth Reading Anyway
CISA's OPC UA LocalDiscoveryServer advisory scores 2.4 on CVSS v4 and needs local access with a keyboard — but it sits in an installer used across five critical sectors, and Rockwell found it.
CISA published ICSA-26-246-01 on 3 September covering the OPC Foundation's OPC UA LocalDiscoveryServer installer at versions earlier than 1.04.420. CVE-2026-77477 is classified CWE-250, execution with unnecessary privileges, and scores 4.6 on CVSS v3.1 but only 2.4 on v4.0. An attacker can intercept a high-privilege console window launched during installation, but must be able to launch an installer with elevated privileges and have access to the keyboard and display. It is not remotely exploitable. The fix is version 1.04.420 or later. The listed sectors are chemical, energy, food and agriculture, water and wastewater, and critical manufacturing; the finder is Lukas Schumaker of Rockwell Automation.
The scores are low and the advisory is still worth two minutes, for a reason that has nothing to do with severity. The LocalDiscoveryServer is the component that lets OPC UA clients find servers on a machine, and it is installed as a dependency by a great many industrial software packages rather than deliberately by an engineer. Most sites running it do not know they are running it, which means the question this advisory really poses is an inventory question: is the LDS present on the engineering workstations, historians and HMI machines, and at what version? Answering that is worth more than the patch.
The flaw itself is a recognisable pattern worth naming, because it recurs. An installer briefly launches a console window running with elevated privileges; on Windows, a process with access to the same desktop can interact with that window. The defence is that installers should not leave elevated interactive windows exposed, and the reason the v4.0 score is lower than the v3.1 score is that the newer framework weights the requirement for local access, a keyboard and user interaction more heavily — which is a fair reflection of how hard this is to exploit.
That said, the machines where this software lives are exactly the machines where "requires local access" is a weak barrier. Engineering workstations are shared between staff and integrators, frequently run with local administrator rights because the vendor tooling demands it, and are the class of asset repeatedly implicated in the past fortnight's advisories — ControlFLASH writing to Everyone, the RMM agent with code execution, and now an installer exposing a privileged console. Individually each is minor. Together they describe a machine that sits inside the OT boundary and is administered like a laptop. The productive response to this advisory is not the patch; it is to treat the engineering workstation as a controlled asset with an inventory, an allowlist and a named owner.