CVE-2026-46621
Yamcs, a mission control framework, had a flaw in its Python script engine that let an authenticated user with the ChangeMissionDatabase privilege modify algorithms to run arbitrary Java code. This could let the attacker execute commands on the host operating system. The issue is fixed in Yamcs 5.12.7 and later, which disable algorithm editing by default.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
spaceapplications yamcs versions earlier than 5.12.7, used by mission control operators who have the ChangeMissionDatabase privilege.
Real-world impact
An attacker could run any code on the Yamcs server, potentially taking full control of the host, exfiltrating data, or disrupting mission operations.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability allows remote code execution with high impact on confidentiality, integrity, and availability, while requiring only low attack complexity and the user’s existing privileged role.
What to do about it
- 01Upgrade Yamcs to version 5.12.7 or later.
- 02Verify that algorithm editing is disabled by default.
- 03Restart the Yamcs service to apply the changes.
NVD-referenced vendor advisory
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 20, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/yamcs/yamcs/commit/3c550348…patch
- github.com/yamcs/yamcs/commit/4ff8fda6…patch
- github.com/yamcs/yamcs/releases/tag/ya…release notes
- github.com/yamcs/yamcs/releases/tag/ya…release notes
- github.com/yamcs/yamcs/security/adviso…exploitvendor advisory