PT-2026-38911 · Universal Robots · Polyscope

Vera Mens · Published 2026-05-08 · Updated 2026-05-31 · CVE-2026-8153

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Universal Robots PolyScope versions prior to 5.25.1

Description OS command injection in the Dashboard Server interface allows an unauthenticated attacker with network access to the Dashboard Server port to craft commands that execute arbitrary code on the robot's operating system. This issue has been confirmed to be exploited in the wild and could lead to remote takeover of industrial robot fleets, potentially causing operational disruption, sabotage, or physical harm to humans. The risk is heightened in environments with poor network segmentation where attackers can move across operational technology (OT) fleets via exposed Ethernet connections on control boxes.

Recommendations Update to version 5.25.1 or later. Restrict access to the Dashboard Server interface to minimize the risk of exploitation.

Fix

RCE

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-8153

Affected Products

Polyscope

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2026-8153 · Security Note
• https://twitter.com/tobi8ur/status/2057466447555600830 · Twitter Post
• https://twitter.com/tobi8ur/status/2056881338016280705 · Twitter Post
• https://twitter.com/NewsNerdie/status/2056646605063729155 · Twitter Post
• https://universal-robots.com/developer/communication-protocol/dashboard-server · Note
• https://reddit.com/r/pwnhub/comments/1thlvlw/critical_vulnerability_exposes_universal_robots · Reddit Post
• https://twitter.com/aviatrixtrc/status/2057151062117687502 · Twitter Post
• https://twitter.com/shah_sheikh/status/2056621689623241088 · Twitter Post
• https://twitter.com/ThreatAft/status/2056664697060090161 · Twitter Post
• https://twitter.com/TweetThreatNews/status/2056680029510074677 · Twitter Post
• https://twitter.com/proficioinc/status/2057385919339262081 · Twitter Post
• https://twitter.com/RoryCrave/status/2056914197909233685 · Twitter Post
• https://twitter.com/Aiz_Cyber/status/2056945508938313742 · Twitter Post
• https://twitter.com/Claroty/status/2061031177851420794 · Twitter Post
• https://reddit.com/r/u_rahul123v45/comments/1tpwjji/critical_flaw_in_universal_robots_cobot_os · Reddit Post