CVE-2026-8153: Universal Robots PolyScope 5 Dashboard Server flaw

What the flaw is

The Dashboard Server is a text interface on Universal Robots controllers that lets other systems load programs, start and stop the robot and check its status. CVE-2026-8153 is an operating-system command injection flaw in that interface: specially crafted commands are passed to the controller's operating system and run there. The Dashboard Server doesn't require a login, so anyone who can reach its port can exploit the flaw.

Why it matters

• Control of the controller. An attacker can run code on the robot controller, change or replace programs, and stop production.
• Spread. On a flat network, a compromised cobot can be used to reach other cobots and connected equipment such as PLCs, grippers and vision systems.
• Safety. Cobots work next to people. Independent safety functions limit physical risk, but a compromised controller must be treated as untrusted until it's restored.

Are you affected?

You're exposed if all three are true:

• You run Universal Robots cobots on PolyScope 5 before version 5.25.1. The version is shown on the teach pendant's About screen.
• The Dashboard Server is enabled on the robot.
• Port 29999 on the robot can be reached from another network, such as the office network, Wi-Fi or a vendor connection.

To check reachability safely, test the port from a computer on a network that should not reach the robot. This only opens a connection and sends no commands:

# Windows PowerShell
Test-NetConnection <robot-ip> -Port 29999

# macOS or Linux
nc -vz <robot-ip> 29999

If the connection succeeds, the Dashboard Server is reachable from that network.

What to do now

1. Inventory. List every Universal Robots cobot and its PolyScope version.
2. Plan the update. Schedule the move to 5.25.1 or later with your integrator in a maintenance window. Back up programs and the installation first, and re-check the safety configuration afterwards.
3. Switch it off if unused. Until you've patched, turn off the Dashboard Server in the robot's security settings if no system uses it.
4. Restrict it if used. If an MES, PLC or script uses the Dashboard Server, use firewall rules so only those specific hosts can reach port 29999.
5. Segment. Keep robots off the internet and off the office network. Put cells behind their own firewall.
6. Look for misuse. Check for unexpected program changes, unexplained stops, and connections to port 29999 from unknown hosts in firewall logs.

Sources

• CISA ICS Advisory ICSA-26-134-17
• CVE-2026-8153 record
• SecurityWeek: Critical vulnerability exposes industrial robot fleets to hacking
• Dark Reading: Patch now, critical flaw in OT robot OS

Common questions

Related