OPC Foundation patches installer flaw that let a bystander hijack setup on industrial servers

Key points

• The OPC Foundation fixed CVE-2026-77477, a flaw in the installer for its OPC UA Local Discovery Server, on 3 September 2026.
• All versions of the UA-LDS installer before 1.04.420 are affected.
• Exploitation requires physical access to the machine during installation, so the bug can't be triggered over the internet.
• Deployments span chemical, energy, water and critical manufacturing sites worldwide.
• Lukas Schumaker of Rockwell Automation reported the issue; no public exploitation has been recorded.

The OPC Foundation has patched a flaw in the OPC UA Local Discovery Server, or LDS, one of the most widely deployed pieces of plumbing on factory and utility networks. Tracked as CVE-2026-77477, it let anyone at the keyboard during installation hijack a high-privilege console window and run their own commands.

LDS is a small background service that helps industrial control software find other OPC UA servers on a network: think of it as the switchboard operator for machines on a plant floor. It runs quietly on engineering workstations and servers in chemical plants, power stations, water utilities and factories.

The fix is in UA-LDS installer 1.04.420 or later. Anything earlier is vulnerable.

How does the attack actually work?

During installation, the LDS installer briefly opens a console window running with elevated system rights. An attacker physically present at the machine while an admin runs the installer can grab that console and type commands into it.

Two conditions are required: an installer launched with admin rights, and access to the keyboard and screen at that moment. This isn't a remote attack. A contractor or disgruntled employee wandering past an unattended install could pull it off; a hacker in another country cannot.

The flaw sits in a category security engineers call Execution with Unnecessary Privileges (CWE-250). A routine part of the installer was handed more power than it needed, and that power leaks to whoever is standing there.

How serious is this in practice?

Medium, and only in the narrow window when someone is actively installing the software. CISA rates it 4.6 out of 10 on the CVSS 3.1 scale and 2.4 on CVSS 4.0. No exploitation has been observed in the wild.

The score undersells the context. Industrial sites often install and reinstall this software on operator stations controlling real physical equipment: pumps, boilers, breakers. A hijacked install on the right machine could hand an insider a foothold on the plant network. Rockwell Automation, whose researcher found this bug, was itself the subject of our 2 September story on a dozen-plus patched flaws in its own industrial software, which gives a sense of how active this corner of the vulnerability landscape has been.

What should operators do now?

Download the fixed installer before rolling out any new LDS deployment. On machines already running an older version, the flaw isn't active outside an install session, so the priority is ensuring the next upgrade uses 1.04.420 or later.

Don't run installers on shared or unattended terminals. If an engineer has to install LDS on a workstation, do it behind a locked door with no one else at the console. Lukas Schumaker of Rockwell Automation reported the issue to the vendor.

This is a plant-floor problem, not a data breach. End users and the public aren't directly in the frame.