CVE-2026-44632
Yamcs, a mission control framework, had a flaw that let an authenticated user with database change rights inject and run Java code on the server. By editing an algorithm through the REST API, the attacker could execute arbitrary commands on the host operating system. The issue is fixed in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Yamcs mission control framework, versions earlier than 5.12.7, for users who can change the mission database via the REST API.
Real-world impact
An attacker could run any code on the server, taking full control of the mission control system and potentially compromising all connected spacecraft or data.
Why this severity
The CVSS score of 9.1 reflects the high impact (confidentiality, integrity, availability) and the fact that the vulnerability can be exploited with low effort once the attacker has legitimate credentials. The requirement for privileged access does not lower the overall severity because the damage is complete system compromise.
What to do about it
- 01Upgrade Yamcs to version 5.12.7 or later.
- 02Restart the Yamcs service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/yamcs/yamcs/commit/3c550348…patch
- github.com/yamcs/yamcs/commit/4ff8fda6…patch
- github.com/yamcs/yamcs/releases/tag/ya…release notes
- github.com/yamcs/yamcs/releases/tag/ya…release notes
- github.com/yamcs/yamcs/security/adviso…exploitvendor advisory