CVE-2026-77477: OPC UA LocalDiscoveryServer Privilege Abuse — Detection and Remediation Guide for OT Defenders

CISA has published ICS Advisory ICSA-26-246-01 covering CVE-2026-77477, a privilege-management flaw in the OPC Foundation's OPC UA LocalDiscoveryServer (LDS) installers. Successful exploitation allows an attacker with local access to intercept a high-privilege console window spawned during the LDS installation process and execute arbitrary commands in that elevated context.

At first glance, a CVSS v3 score of 4.6 (Medium) and a local-only attack vector may look like a low-priority patch item. That reading is dangerous in the environments where LDS actually lives. The LocalDiscoveryServer is a core component of OPC UA deployments — the discovery mechanism that lets OPC UA clients and servers find each other on a network — and it is routinely installed on engineering workstations, HMI servers, and historian hosts across Chemical, Energy, Food and Agriculture, Water and Wastewater, and Critical Manufacturing sectors worldwide. These are exactly the systems where a local foothold plus an elevated installer console equals full host compromise, and where host compromise is a stepping stone into the control network.

The vulnerability is classified as CWE-250: Execution with Unnecessary Privileges. The fix is straightforward: update to UA-LDS-Installers version 1.04.420 or later. The harder problem — and the focus of this post — is finding where vulnerable installers are staged or executing in your environment, and making sure installation activity on OT assets is both monitored and controlled.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works

The flaw sits in the installer, not the LDS service itself. During installation, the LDS installer launches a console (terminal) window that runs with elevated privileges — typically the high-integrity context required to register services and write to protected directories. Because the installer executes with unnecessary privileges and exposes that console, a local attacker can interact with or hijack the elevated terminal session while the installation is in progress and run arbitrary commands that inherit its privilege level.

From a defender's perspective, the attack chain looks like this:

1. An administrator (or an automated software-deployment tool) launches a vulnerable UA-LDS installer on a target host.
2. The installer spawns a high-privilege console window as part of its workflow.
3. An attacker with an existing local foothold — even as a standard user — interacts with that console window during the installation window of opportunity.
4. Commands typed or injected into that console execute in the installer's elevated context, yielding privilege escalation and arbitrary command execution.

Exploitation requirements matter here: the attacker needs local access to the host and must time the interaction to coincide with an active installation. This is not a remote, wormable bug. It is a classic opportunistic privilege-escalation primitive — the kind that turns a low-value initial access (phished standard user on an engineering workstation, compromised contractor laptop, malicious insider) into SYSTEM-level control during a routine maintenance action.

Exploitation Status

As of the advisory publication, there are no confirmed reports of in-the-wild exploitation, and CVE-2026-77477 has not been added to the CISA Known Exploited Vulnerabilities catalog. Public proof-of-concept code has not been observed. However, the technique — abusing elevated installer consoles and installation-time race conditions — is well understood, requires no specialized exploit development, and should be treated as trivially reproducible by a competent operator with local access. Do not let the "Medium" CVSS score or the absence of a public PoC drive deprioritization on OT assets.

Detection & Response

Because exploitation requires a local actor to interact with an elevated installer console, the highest-fidelity detections focus on two observables: (1) execution of vulnerable LDS installer packages, and (2) suspicious child processes or interactive shells spawned in the installer's context during the installation window.

Sigma Rules

---
title: OPC UA LDS Vulnerable Installer Execution
id: 3f7a91c2-4b6d-4e58-a921-8c0d2e5f7a31
status: experimental
description: Detects execution of OPC Foundation UA LocalDiscoveryServer installer packages potentially affected by CVE-2026-77477 (versions prior to 1.04.420). Installation activity on OT assets should be rare, scheduled, and attributable to a change ticket.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-01
author: Security Arsenal
date: 2026/09/03
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\ua_lds_install.exe'
      - '\opc-ua-lds-setup.exe'
  selection_name:
    OriginalFileName|contains:
      - 'UA-LDS'
      - 'LocalDiscoveryServer'
  selection_cmd:
    CommandLine|contains:
      - 'UA-LDS'
      - 'LocalDiscoveryServer'
  condition: 1 of selection_*
falsepositives:
  - Legitimate scheduled LDS upgrades performed by OT engineering under change control
level: medium
---
title: Interactive Shell Spawned During Software Installation Window
id: 8b2e4d17-9a3c-4f61-b735-2d9e1a6c4f08
status: experimental
description: Detects cmd.exe, powershell.exe, or other interactive shells launched as child processes of installer processes (msiexec, setup binaries, OPC UA LDS installers). Consistent with CVE-2026-77477 exploitation, where an attacker hijacks an elevated installer console to run arbitrary commands.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-01
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/03
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msiexec.exe'
      - '\ua_lds_install.exe'
      - '\setup.exe'
      - '\install.exe'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_shell
falsepositives:
  - Installers that legitimately execute post-install scripts; correlate with approved change tickets and known-good software inventory
level: high

Analyst note on tuning: Rule two will fire on some legitimate installers that call post-install scripts. That is acceptable — but scope it. On OT assets, software installation should never be ad-hoc. If this rule fires outside an approved maintenance window or without a corresponding change record, treat it as a priority-two investigation at minimum.

KQL Hunt (Microsoft Sentinel / Defender)

The following query hunts for vulnerable LDS installer execution and interactive shells spawned by installer processes across endpoints reporting to Defender for Endpoint. It is intentionally scoped to high-value OT/engineering assets via a watchlist pattern — adjust the device-name filter to your environment's naming convention.

// Hunt: OPC UA LDS installer execution + installer-spawned interactive shells (CVE-2026-77477)
let Lookback = 30d;
let OTAssets = dynamic(["ENG-", "HMI-", "HIST-", "OT-", "EWS-"]); // adjust to your OT naming convention
let InstallerNames = dynamic(["msiexec.exe", "setup.exe", "install.exe", "ua_lds_install.exe"]);
let ShellNames = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe"]);
union
(DeviceProcessEvents
 | where Timestamp > ago(Lookback)
 | where FileName has_any ("ua_lds", "LocalDiscoveryServer")
    or ProcessCommandLine has_any ("UA-LDS", "LocalDiscoveryServer")
 | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath, HuntHit="LDS Installer Execution"),
(DeviceProcessEvents
 | where Timestamp > ago(Lookback)
 | where InitiatingProcessFileName in~ (InstallerNames)
 | where FileName in~ (ShellNames)
 | where DeviceName has_any (OTAssets)
 | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, HuntHit="Installer-Spawned Shell")
| sort by Timestamp desc

For environments ingesting Sysmon via Sentinel's SecurityEvent table (Event 4688 with command-line auditing is the equivalent), the same logic applies: join parent process names against the installer list and flag shell children on OT assets.

Velociraptor VQL Hunt

Use this artifact to sweep the OT fleet for live evidence: running LDS installer processes, installer-spawned shells, and on-disk installer artifacts staged in common download/temp locations.

-- CVE-2026-77477: Hunt for OPC UA LDS installer execution and staged installer artifacts
-- Part 1: Live processes matching LDS installer or installer-spawned shells
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(ua_lds|LocalDiscoveryServer)'
   OR CommandLine =~ '(?i)(UA-LDS|LocalDiscoveryServer)'
   OR (Name =~ '(?i)^(cmd|powershell|pwsh|wscript|cscript|rundll32)\.exe$'
       AND CommandLine =~ '(?i)(install|setup|msiexec)')

-- Part 2: Staged LDS installer binaries on disk
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/Downloads/*[Ll][Dd][Ss]*.exe',
  'C:/Users/*/Downloads/*LocalDiscoveryServer*',
  'C:/Temp/**/*[Ll][Dd][Ss]*.exe',
  'C:/ProgramData/**/UA-LDS*',
  'C:/Windows/Temp/**/*[Ll][Dd][Ss]*.exe'
])

Remediation and Verification Script

The following PowerShell checks hosts for installed LDS versions, flags anything below 1.04.420, and inventories staged installer artifacts. Run it via your EDR's live-response capability or your software-distribution platform against engineering workstations, HMI servers, and historians. It makes no changes by default — removal of vulnerable installers should be a deliberate, change-controlled action on OT systems.

# CVE-2026-77477 - OPC UA LDS vulnerable version auditor (read-only)
# Run as Administrator on engineering workstations, HMI servers, historians

$FixedVersion = [version]"1.04.420"
$report = [System.Collections.Generic.List[object]]::new()

# Check registry uninstall hives for installed LDS instances
$uninstallPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($path in $uninstallPaths) {
  Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Local ?Discovery ?Server|UA-LDS|OPC UA' } |
    ForEach-Object {
      $installed = $null
      [void][version]::TryParse(($_.DisplayVersion -replace '[^0-9\.]', ''), [ref]$installed)
      $vulnerable = ($null -ne $installed) -and ($installed -lt $FixedVersion)
      $report.Add([pscustomobject]@{
        Host        = $env:COMPUTERNAME
        Product     = $_.DisplayName
        Version     = $_.DisplayVersion
        Vulnerable  = $vulnerable
        InstallPath = $_.InstallLocation
      })
    }
}

# Check for staged vulnerable installer artifacts in common locations
$stagingDirs = @("$env:SystemDrive\Temp", "$env:WINDIR\Temp", "$env:ProgramData")
$stagingDirs += Get-ChildItem "$env:SystemDrive\Users" -Directory -ErrorAction SilentlyContinue |
  ForEach-Object { Join-Path $_.FullName 'Downloads' }
foreach ($dir in $stagingDirs) {
  Get-ChildItem -Path $dir -Recurse -Depth 2 -Include '*LDS*.exe','*LocalDiscoveryServer*' -ErrorAction SilentlyContinue |
    ForEach-Object {
      $report.Add([pscustomobject]@{
        Host        = $env:COMPUTERNAME
        Product     = 'STAGED INSTALLER ARTIFACT'
        Version     = ($_.VersionInfo.ProductVersion)
        Vulnerable  = $true
        InstallPath = $_.FullName
      })
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\LDS_CVE-2026-77477_Audit_$env:COMPUTERNAME.csv" -NoTypeInformation
if ($report | Where-Object Vulnerable) {
  Write-Warning "Vulnerable LDS version or staged installer found. Remediate to UA-LDS-Installers 1.04.420+ per CISA ICSA-26-246-01."
}

Remediation

1. Patch immediately on IT-adjacent OT assets; schedule on constrained systems. Update all OPC UA LDS installations to UA-LDS-Installers version 1.04.420 or later. Obtain the fixed installer from the OPC Foundation's official distribution channels — verify hashes before execution on OT systems.
2. Control the installation window. Because exploitation requires a local actor to interact with the elevated installer console, apply compensating controls during any installation on OT assets: perform installations from an offline/locked session, restrict local logon during maintenance, and prefer unattended/silent installation methods that do not expose an interactive elevated console where supported.
3. Enforce least privilege on OT hosts. Standard users on engineering workstations and HMI servers should never hold local administrator rights. An attacker who lands as a standard user has a far harder time reaching an elevated console if workstation hardening (CIS Controls 4, 5, and 6) is in place.
4. Application control. Deploy application allowlisting (Windows Defender Application Control or equivalent) on OT assets so that only signed, approved installer packages can execute. This both blocks rogue installer artifacts and shrinks the window in which a staged vulnerable installer could be launched.
5. Sweep for staged installers. Use the audit script and VQL above to locate and remove vulnerable installer packages left in Downloads, Temp, and software-staging shares. Vulnerable installers on a file share are a latent escalation path on every host that mounts it.
6. Monitor installation activity as a high-signal event. Software installation on OT assets should be rare, ticketed, and alerted. Route the Sigma and KQL detections above into your SOC pipeline with OT asset context applied.
7. Follow CISA's standing ICS guidance: minimize network exposure for control system devices, isolate control networks behind firewalls from business networks, and where remote access is required, use hardened VPN or secure remote-access paths kept current.

References:

• CISA ICS Advisory ICSA-26-246-01: https://www.cisa.gov/news-events/ics-advisories/icsa-26-246-01
• CSAF document (linked from the CISA advisory) for machine-readable affected-product data
• OPC Foundation official LDS distribution: https://opcfoundation.org/

No CISA KEV deadline currently applies to this CVE. That said, given the affected sectors and the trivial nature of the escalation technique, Security Arsenal recommends treating remediation as a 30-day action on any OT asset with multi-user or remote access.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub