CVE-2026-1579

CRITIQUE 9.8CVE-2026-1579 · Published 31/03/2026 · updated 29/07/2026

En bref

CVE-2026-1579 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant autopilot (px4).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.96%, plus élevée que 61.6% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
autopilot px4	`= 1.16.0`	No fix yet

Description

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides interactive shell access -- can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides MAVLink 2.0 message signing as the cryptographic authentication mechanism for all MAVLink communication. When signing is enabled, unsigned messages are rejected at the protocol level.

References

docs.px4.io/main/en/mavlink/message_signing · Product
docs.px4.io/main/en/mavlink/security_hardening · Product
cisagov/CSAF · Third Party Advisory
cisa.gov/news-events/ics-advisories/icsa-26-090-02 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free