CVE-2026-1579

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1579", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2026-01-28T22:27:22.970Z", "datePublished": "2026-03-31T20:20:06.506Z", "dateUpdated": "2026-03-31T20:36:09.044Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-31T20:20:06.506Z"}, "title": "PX4 Autopilot Missing authentication for critical function", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "PX4", "product": "Autopilot", "versions": [{"status": "affected", "version": "v1.16.0 SITL"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level."}]}], "references": [{"url": "https://docs.px4.io/main/en/mavlink/security_hardening"}, {"url": "https://docs.px4.io/main/en/mavlink/message_signing"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "PX4 recommends enabling MAVLink 2.0 message signing as the \nauthentication mechanism for all non\u2011USB communication links. PX4 has \npublished a security hardening guide for integrators and manufacturers \nat\u00a0\n https://docs.px4.io/main/en/mavlink/security_hardening \n\n\nMessage signing configuration documentation can be found at\u00a0\n https://docs.px4.io/main/en/mavlink/message_signing", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>PX4 recommends enabling MAVLink 2.0 message signing as the \nauthentication mechanism for all non\u2011USB communication links. PX4 has \npublished a security hardening guide for integrators and manufacturers \nat&nbsp;<br><a href=\"https://docs.px4.io/main/en/mavlink/security_hardening\" title=\"(opens in a new window)\">https://docs.px4.io/main/en/mavlink/security_hardening</a></p><p><br>Message signing configuration documentation can be found at&nbsp;<br><a href=\"https://docs.px4.io/main/en/mavlink/message_signing\" title=\"(opens in a new window)\">https://docs.px4.io/main/en/mavlink/message_signing</a></p>"}]}], "credits": [{"lang": "en", "value": "Dolev Aviv of Cyviation reported this vulnerability to CISA.", "type": "finder"}], "source": {"advisory": "ICSA-26-090-02", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T20:35:56.040324Z", "id": "CVE-2026-1579", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T20:36:09.044Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1579", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-31T20:35:56.040324Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T20:36:03.968Z"}}], "cna": {"title": "PX4 Autopilot Missing authentication for critical function", "source": {"advisory": "ICSA-26-090-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Dolev Aviv of Cyviation reported this vulnerability to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PX4", "product": "Autopilot", "versions": [{"status": "affected", "version": "v1.16.0 SITL"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "PX4 recommends enabling MAVLink 2.0 message signing as the \nauthentication mechanism for all non\u2011USB communication links. PX4 has \npublished a security hardening guide for integrators and manufacturers \nat\u00a0\n https://docs.px4.io/main/en/mavlink/security_hardening \n\n\nMessage signing configuration documentation can be found at\u00a0\n https://docs.px4.io/main/en/mavlink/message_signing", "supportingMedia": [{"type": "text/html", "value": "<p>PX4 recommends enabling MAVLink 2.0 message signing as the \nauthentication mechanism for all non\u2011USB communication links. PX4 has \npublished a security hardening guide for integrators and manufacturers \nat&nbsp;<br><a href=\"https://docs.px4.io/main/en/mavlink/security_hardening\" title=\"(opens in a new window)\">https://docs.px4.io/main/en/mavlink/security_hardening</a></p><p><br>Message signing configuration documentation can be found at&nbsp;<br><a href=\"https://docs.px4.io/main/en/mavlink/message_signing\" title=\"(opens in a new window)\">https://docs.px4.io/main/en/mavlink/message_signing</a></p>", "base64": false}]}], "references": [{"url": "https://docs.px4.io/main/en/mavlink/security_hardening"}, {"url": "https://docs.px4.io/main/en/mavlink/message_signing"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02"}, {"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level.", "supportingMedia": [{"type": "text/html", "value": "The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2026-03-31T20:20:06.506Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1579", "state": "PUBLISHED", "dateUpdated": "2026-03-31T20:36:09.044Z", "dateReserved": "2026-01-28T22:27:22.970Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2026-03-31T20:20:06.506Z", "assignerShortName": "icscert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Autopilot", "vendor": "PX4", "versions": [{"status": "affected", "version": "v1.16.0 SITL"}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:px4:autopilot:1.16.0:-:*:*:*:*:*:*", "matchCriteriaId": "03F7087C-BED0-41D3-83A8-75FA8B7DB38F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MAVLink communication protocol does not require cryptographic \nauthentication by default. When MAVLink 2.0 message signing is not \nenabled, any message -- including SERIAL_CONTROL, which provides \ninteractive shell access -- can be sent by an unauthenticated party with\n access to the MAVLink interface. PX4 provides MAVLink 2.0 message \nsigning as the cryptographic authentication mechanism for all MAVLink \ncommunication. When signing is enabled, unsigned messages are rejected \nat the protocol level."}, {"lang": "es", "value": "El protocolo de comunicaci\u00f3n MAVLink no requiere autenticaci\u00f3n criptogr\u00e1fica por defecto. Cuando la firma de mensajes MAVLink 2.0 no est\u00e1 habilitada, cualquier mensaje -- incluyendo SERIAL_CONTROL, que proporciona acceso interactivo a la shell -- puede ser enviado por una parte no autenticada con acceso a la interfaz MAVLink. PX4 proporciona la firma de mensajes MAVLink 2.0 como el mecanismo de autenticaci\u00f3n criptogr\u00e1fica para toda la comunicaci\u00f3n MAVLink. Cuando la firma est\u00e1 habilitada, los mensajes no firmados son rechazados a nivel de protocolo."}], "id": "CVE-2026-1579", "lastModified": "2026-07-29T19:31:46.707", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1579", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T20:35:56.040324Z", "version": "2.0.3"}}]}, "published": "2026-03-31T21:16:27.897", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://docs.px4.io/main/en/mavlink/message_signing"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Product"], "url": "https://docs.px4.io/main/en/mavlink/security_hardening"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory"], "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-090-02.json"}, {"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-090-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "v1.16.0 SITL"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "Autopilot", "source": "cna", "vendor": "PX4"}, "product": "px4-autopilot", "vendor": "px4"}], "analysis": {"en": {"generated_at": "2026-04-07T23:57:02.420806+00:00", "value": {"mitigation_remediation": ["Enable MAVLink 2.0 message signing on all non\u2011USB communication links as recommended by PX4.", "Follow the PX4 security hardening guide for detailed integration steps and configuration.", "Verify that the autopilot rejects unsigned messages by testing or confirming the signing setting is active.", "Consider network segmentation or firewall rules to limit access to the MAVLink interface."], "summary": {"action": "Enable Signing", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of PX4 Autopilot, specifically firmware version 1.16.0 as identified by the CPE string, are affected. Users who have not enabled MAVLink 2.0 message signing on any non\u2011USB communication link are exposed to this risk.", "description_and_impact": "The MAVLink communication protocol does not enforce cryptographic authentication unless MAVLink 2.0 message signing is activated. When signing is disabled, any party that can reach the interface can send unsigned messages, including the SERIAL_CONTROL command which grants a shell on the PX4 autopilot. This allows an attacker to execute arbitrary commands, effectively taking control of the flight controller and compromising the vehicle\u2019s confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 9.3 reflects a severe vulnerability. The low EPSS score (<1%) suggests that widespread exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. The most plausible attack vector involves any unauthorized access to the MAVLink interface, such as over wireless telemetry or ground\u2011station connections, where an attacker can inject the unsigned messages that the autopilot will accept."}}}}, "created": "2026-04-02T07:52:53.509035+00:00", "updated": "2026-04-08T20:00:05.260121+00:00", "vendors": ["px4", "px4$PRODUCT$px4-autopilot"]}