CVE-2026-8153: Universal Robots PolyScope OS Command Injection in Dashboard Server

Overview

CVE-2026-8153 describes an OS command injection weakness (CWE-78) in the Dashboard Server interface of Universal Robots PolyScope. The record states that the issue affects versions prior to 5.25.1. The vendor reference listed in the record documents the Dashboard Server communication protocol.

Impact

• The record states that an unauthenticated attacker can craft commands that execute code on the robot's operating system.
• The CVSS 3.1 base score of 9.8 (critical) supplied by the CNA reflects network attack vector, low complexity, no privileges and no user interaction, with high confidence, integrity and availability impact.
• Code execution on a robot controller can affect physical processes and connected equipment; the record does not describe any specific consequence, so the operational impact in a given site is unknown.

Affected products and versions

• Product: Universal Robots PolyScope, Dashboard Server interface.
• Affected range as described in the record: versions prior to 5.25.1.
• The record does not include a structured list of affected versions or fixed builds. Organizations should confirm exact affected builds with the vendor.

Exploitation status

• The CISA KEV catalog does not list this CVE in the record, so no confirmed exploitation in the wild is recorded in the sources consulted.
• The EPSS probability in the record is 0.0299 (about 3%) with a percentile of 0.86993. EPSS is a statistical estimate of exploitation likelihood, not evidence of exploitation.

Remediation and mitigation

• Identify all PolyScope installations and confirm their version. Systems earlier than 5.25.1, as stated in the record, should be prioritized for review.
• Consult the vendor's guidance and upgrade to a fixed release. The record does not name the fixed build, so the vendor advisory must be used to confirm the correct version.
• Until patched, restrict network access to the robot controller and its dashboard interface to trusted management networks, and segment robot networks from general IT and internet-facing segments.
• Limit who can reach engineering and management interfaces, and review firewall rules for unnecessary exposure.

Detection guidance

• Review network logs for unexpected connections to the dashboard interface, especially from untrusted or unknown hosts.
• Monitor the robot controller for unexpected processes, configuration changes, or new files, and compare against known-good baselines.
• Correlate anomalies in robot behavior with network activity to support incident triage.

Limitations of the available information

• The record was in Awaiting Analysis status at the time of collection, so NVD has not yet published its own assessment or structured version data.
• No affected or fixed version lists, vendor advisory text, or proof-of-concept details are included in the record. Those points are unknown here.
• The EPSS date in the record is later than the publication date; this analysis reports it as given without interpreting it further.

Frequently asked questions

What is CVE-2026-8153?

It is an OS command injection vulnerability in the Dashboard Server interface of Universal Robots PolyScope, affecting versions prior to 5.25.1 according to the record.

Does this CVE require authentication to exploit?

The record states that the attacker is unauthenticated. Organizations should still treat the Dashboard Server interface as sensitive and restrict network access.

Is this CVE known to be actively exploited?

The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.