Critical Universal Robots Vulnerability Exposes Industrial Cobot Fleets to Remote Hijacking
Universal Robots has patched a critical vulnerability affecting its PolyScope 5 operating system that could allow attackers to remotely execute arbitrary commands on industrial cobots. The flaw, rated 9.8 out of 10 on the CVSS scale, exposes fleets of collaborative robots to complete compromise if left unpatched.
The Vulnerability: CVE-2026-8153
Tracked as CVE-2026-8153, the vulnerability is an OS command injection flaw in the Dashboard Server interface of PolyScope 5. The Dashboard Server accepts user-controlled input and passes it to the underlying operating system without proper neutralization of special elements, enabling unauthenticated attackers with network access to craft commands that execute directly on the robot's OS.
Universal Robots explained: "An unauthenticated attacker with network access to the Dashboard Server port can craft commands that are executed on the robot's operating system, leading to remote code execution and compromise of the controller with high impact to confidentiality, integrity, and availability."
Attack Requirements
Remote exploitation requires two conditions:
- The robot's Dashboard Server must be enabled in the UI - The Dashboard Server port must be reachable by the attacker
Universal Robots noted that their robots are not designed to be directly accessible from the Internet, and direct inbound access is typically prevented by corporate firewalls. However, this assumption of network isolation is increasingly fragile in modern industrial environments.
The OT Network Reality
Vera Mens, the Claroty security researcher who discovered and reported the vulnerability, highlighted a critical gap between vendor assumptions and real-world deployments:
"While many industrial robots lack a remote management interface, cobots made by Universal Robots have a control box with an Ethernet port that can be used on demand. Customers may use this option to deliver information to a central management unit, to use legacy field protocols such as MODBUS and EtherNet/IP to manipulate other OT equipment, or to control the cobot remotely."
Mens added: "Although these networks are generally not publicly exposed, they are often flat and lack proper segmentation; therefore, gaining an initial foothold may not be difficult."
Impact Escalation
The consequences of exploitation extend far beyond a single compromised robot:
- Single Cobot: Complete control of the robot's movements and operations, potentially posing physical hazards to human workers nearby. - Fleet Compromise: Lateral movement to other cobots and peripherals on the same network segment. - OT Equipment: The control box is a general-purpose Linux computer connected via Ethernet and serial ports to other equipment. Compromise can cascade to PLCs, sensors, and other industrial systems.
Remediation
Universal Robots has patched the vulnerability in PolyScope 5.25.1. Organizations must:
- Update immediately to PolyScope 5.25.1 or later - Disable the Dashboard Server if not actively used - Segment OT networks to isolate cobots from general IT infrastructure - Monitor network traffic for unauthorized access to robot controllers - Implement firewall rules to restrict access to Dashboard Server ports
Reflection
CVE-2026-8153 is a stark reminder that industrial robots are no longer isolated machines—they are networked Linux computers with physical actuation capabilities. The convergence of IT and OT means that a vulnerability in a cobot's software can have consequences far beyond data loss: it can cause physical damage, disrupt production lines, and endanger human workers.
For manufacturers and integrators, the lesson is unequivocal: network segmentation is not optional. Flat OT networks that allow unrestricted lateral movement between IT and OT assets are an invitation to disaster. As Industry 4.0 continues to blur the lines between digital and physical systems, security must be treated as a safety requirement—not an IT afterthought.