OPC Foundation patches installer flaw that let a bystander hijack setup on industrial servers

Key points

• The OPC Foundation fixed CVE-2026-77477, a flaw in the installer for its OPC UA Local Discovery Server, on 3 September 2026.
• All versions of the UA-LDS installer before 1.04.420 are affected.
• Exploitation requires physical access to the machine during installation, so the bug cannot be triggered over the internet.
• Deployments span chemical, energy, food and agriculture, water, and critical manufacturing sites worldwide.
• Lukas Schumaker of Rockwell Automation reported the issue; no public exploitation has been recorded.

The OPC Foundation has patched a flaw in one of the most widely deployed pieces of plumbing on factory and utility networks: the OPC UA Local Discovery Server, or LDS. The bug, tracked as CVE-2026-77477, let anyone standing at the keyboard during installation hijack a high-privilege console window and run their own commands on the machine.

LDS is a small background service that helps industrial control software find other OPC UA servers on a network. Think of it as the switchboard operator for machines on a plant floor. It runs quietly on engineering workstations and servers in chemical plants, power stations, food processing sites, water utilities and factories.

The fix is in UA-LDS installer 1.04.420 or later. Anything earlier is vulnerable.

How does the attack actually work?

During installation, the LDS installer briefly opens a console window running with elevated system rights. If an attacker is physically present at the machine while an admin is installing the software, they can grab that console and type commands into it.

That means they need two things: an installer being launched with admin rights, and access to the keyboard and screen at that moment. It is not a remote attack. A hacker in another country cannot use this. A contractor, cleaner or disgruntled employee wandering past an unattended install could.

The flaw sits in a category security engineers call Execution with Unnecessary Privileges (CWE-250). In plain terms, a routine part of the installer was handed more power than it needed, and that power leaks to whoever is standing there.

How serious is this in practice?

Medium, and only in the narrow window when someone is installing the software. CISA, the US Cybersecurity and Infrastructure Security Agency that published the advisory, rates it 4.6 out of 10 on the older CVSS 3.1 scale and just 2.4 on the newer CVSS 4.0 scale.

No one has been seen exploiting it in the wild. The vendor is US-based; deployments are global.

The reason it matters despite the modest score is where LDS runs. Industrial sites often install and reinstall this software on operator stations that control real physical equipment: pumps, boilers, mixers, breakers. A single hijacked install on the right machine could give an insider a foothold on the plant network.

What should operators do now?

Download the fixed installer from the OPC Foundation before rolling out any new LDS deployment. On machines already running an older version, the flaw is not active outside of an install session, so the priority is making sure the next upgrade uses 1.04.420 or later.

Do not run installers on shared or unattended terminals. If an engineer has to install LDS on a workstation, do it behind a locked door, or at least with no one else at the console. Lukas Schumaker of Rockwell Automation reported the issue to the vendor.

Customers and members of the public are not directly affected here. This is a plant-floor problem, not a data breach.