Universal Robots has patched a critical remote-code-execution vulnerability in PolyScope 5, the operating system that powers its industry-leading line of collaborative robots. Tracked as CVE-2026-8153 and carrying a maximum-severity CVSS score of 9.8, the flaw lets an unauthenticated network attacker execute arbitrary commands on the cobot controller — potentially giving them control over safety configurations, robot motion and connected OT peripherals.
The vulnerability, in plain English
The Dashboard Server on PolyScope 5 accepts user-supplied input and passes it to the underlying operating system without proper neutralization of special characters — a textbook OS command-injection bug. Any attacker who can reach the Dashboard Server's TCP port over the network can craft commands that run as the cobot's system user, resulting in full compromise of the controller and, as the vendor put it, "high impact to confidentiality, integrity, and availability." Universal Robots has fixed the issue in PolyScope 5.25.1 and CISA published matching guidance in advisory ICSA-26-134-17.
Discovery and disclosure
CVE-2026-8153 was reported by Vera Mens of Claroty's Team82. Universal Robots emphasises that its cobots are not designed to face the public internet and that outbound firewalls typically block direct access to the Dashboard Server port. Mens, however, warns that many OT deployments run flat, unsegmented networks — and that once an attacker gains a foothold on the same LAN, "the impact can escalate to compromise of an entire fleet of cobots and their peripherals."
Why it matters for factories
UR arms are ubiquitous in manufacturing, logistics, life sciences and automotive assembly, sitting inside safety-critical workcells alongside humans. The Dashboard Server is normally used to integrate cobots with central MES systems and to bridge to field protocols such as MODBUS and EtherNet/IP, which broadens the blast radius: a compromised cobot could be used to pivot to other PLCs or drive the robot into unsafe motion. Operators are advised to apply PolyScope 5.25.1 immediately, disable the Dashboard Server when not required, and enforce network segmentation between cobots and enterprise IT.
Part of a wider OT patch cycle
The disclosure lands as industrial cyber advisories continue to accelerate — a trend echoed by recent ransomware incidents targeting PTC Windchill and FlexPLM and the Xen Project's new safety committee for robotics and automotive hypervisors. Manufacturers should treat cobots the same way they treat any other critical OT asset: patch fast, log everything on the Dashboard Server, and put them behind proper OT segmentation.
Reporting based on advisories from CISA and Universal Robots, and coverage from SecurityWeek and Dark Reading.