Satel advises users to update to Satel Netco Design v2.1.7, the vendor fix that advisory ICSA-26-281-03 lists for four vulnerabilities in the communications-sector software. The Cybersecurity and Infrastructure Security Agency (CISA) documented those flaws in advisory ICSA-26-281-03 on October 8, 2026, covering stored cross-site scripting, inefficient regular expression complexity, and two relative path traversal issues. One vendor update, v2.1.7, resolves all four.
What happened
CISA published advisory ICSA-26-281-03 on October 8, 2026 for Satel Netco Design, software Satel makes in Finland and deploys worldwide in the communications sector. CISA states that successful exploitation could let an attacker run arbitrary scripts in a user’s browser, consume excessive system resources, enumerate files, create or modify files, and under certain conditions execute arbitrary code. CISA credited Alex Williams of Pellera Technologies with reporting the vulnerabilities.
Are you affected?
The advisory lists all Satel Netco Design versions prior to v2.1.7 as affected across the four CVEs. If your business runs this software, or an agency runs it for you, the version number on the running instance is what decides exposure: anything below v2.1.7 is in scope. Every one of the four flaws requires an authenticated account, so the people who matter here are whoever holds Viewer and Network Operator access, not an anonymous visitor from the internet.
The National Vulnerability Database shows the two path traversal entries published October 8, 2026 and last modified October 9, 2026, with ICS-CERT listed as the source. For the two path traversal records, NIST notes that the NVD assessment is "not yet provided" and that the CVSS v4 vectors come from the ICS-CERT CNA rather than from NIST’s own analysts.
| CVE | Type | Account needed | What it allows | CVSS v4 / v3.1 (CISA) |
|---|---|---|---|---|
| CVE-2026-105269 | Stored cross-site scripting (CWE-79) | Network Operator | Store untrusted content that runs as a script in another user’s browser when viewed | 8.5 HIGH / 6.8 MEDIUM |
| CVE-2026-104628 | Inefficient regular expression complexity (CWE-1333) | Viewer | Submit crafted search input that causes excessive processing and can degrade availability | 7.1 HIGH / 6.5 MEDIUM |
| CVE-2026-105275 | Relative path traversal, data import (CWE-23) | Viewer | Reach file paths outside the intended directory and tell from responses whether files exist on the host | 5.3 MEDIUM / 4.3 MEDIUM |
| CVE-2026-101024 | Relative path traversal, data export (CWE-23) | Viewer | Write attacker-influenced content to file locations the application service can reach, which can lead to unauthorized file creation or modification and, under certain conditions, arbitrary code execution | 8.7 HIGH / 8.8 HIGH |
The export-side path traversal, CVE-2026-101024, could result in unauthorized file creation or modification and, under certain conditions, arbitrary code execution. CISA reported on October 8, 2026 that no known public exploitation specifically targeting these vulnerabilities had been reported to it at that time.
What to do now
If an agency runs your systems, this is a short list to raise with them rather than something to change yourself. The points below come from CISA’s advisory and its defence-in-depth guidance.
- Ask which version of Satel Netco Design you run. Satel advises users to update to v2.1.7, which the advisory lists as the fix for all four CVEs.
- Ask who holds Viewer and Network Operator accounts.
- Ask whether the system is reachable from the public internet. CISA recommends minimizing network exposure for control system devices and keeping them behind firewalls, isolated from business networks.
- Ask how remote access is handled. CISA advises that "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available," and notes a VPN is only as secure as the devices connected to it.
- Confirm there is a process to track CISA and vendor advisories so the next one reaches the right person quickly.
What an agency checks when an advisory lands
An agency that looks after client software reads vendor and CISA advisories, matches the affected product and version against what each client actually runs, and schedules the patch. For this one the checks are straightforward: an agency can confirm which version each client runs, whether the instance is reachable from the internet, and who can sign in to it. CISA also asks organizations that see suspected malicious activity to follow their internal procedures and report findings to it for tracking and correlation against other incidents.
The four issues hit different parts of the system. The cross-site scripting flaw targets another user’s browser session, the regular expression flaw targets availability, and the two path traversal flaws target the file system. Satel advises users to update to Satel Netco Design v2.1.7, which the advisory lists as the vendor fix for all four CVEs.
FAQ
Which Satel Netco Design versions are affected?
CISA lists all versions prior to v2.1.7 as affected across the four CVEs in advisory ICSA-26-281-03, published October 8, 2026.
How are the vulnerabilities fixed?
Satel advises users to update to Satel Netco Design v2.1.7, which the advisory lists as the vendor fix for all four issues.
Have these vulnerabilities been exploited?
CISA reported on October 8, 2026 that no known public exploitation specifically targeting these vulnerabilities had been reported to it at that time.
Sources
Want help with this in Myrtle Beach or Long Island? Talk to us.
NewSunSEO
Grow in Google and AI Search
AI-SEO, local search, paid ads and websites from one team, with offices on Long Island and in Myrtle Beach.
- AI-SEO
- Local AI-SEO
- AI Consulting
- PPC
- Web Design
- Web Development
- Long Island Office(631) 320-1700
- Myrtle Beach Office(843) 492-7131
Request a Free Proposal
Tell us about your business and where you want to grow.
We will reply by email to talk through your goals and what a proposal would include.
We use your details only to reply to you and send what you asked for. See our Privacy Policy.
