CVE-2026-26742

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-26742", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-11T14:51:09.728Z", "dateReserved": "2026-02-16T00:00:00.000Z", "datePublished": "2026-03-10T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-10T18:46:21.891Z"}, "descriptions": [{"lang": "en", "value": "PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the \"Re-arm Grace Period\" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-862", "lang": "en", "description": "CWE-862 Missing Authorization"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:50:24.469152Z", "id": "CVE-2026-26742", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:51:09.728Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-26742", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:50:24.469152Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:48:44.599Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md"}], "descriptions": [{"lang": "en", "value": "PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the \"Re-arm Grace Period\" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-10T18:46:21.891Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26742", "state": "PUBLISHED", "dateUpdated": "2026-03-11T14:51:09.728Z", "dateReserved": "2026-02-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-10T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A8C03F6-C15B-44A0-8FF2-05E73A47F26E", "versionEndExcluding": "1.16.0", "versionStartIncluding": "1.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the \"Re-arm Grace Period\" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control."}, {"lang": "es", "value": "Las versiones 1.12.x a 1.15.x del Autopiloto PX4 contienen un fallo en el mecanismo de protecci\u00f3n en la l\u00f3gica del 'Per\u00edodo de Gracia de Rearmado'. El sistema aplica incorrectamente la l\u00f3gica de rearmado de emergencia en vuelo a escenarios en tierra. Si un piloto cambia al modo Manual y rearma en un plazo de 5 segundos (configuraci\u00f3n predeterminada) despu\u00e9s de un aterrizaje autom\u00e1tico, el sistema omite todas las comprobaciones de seguridad previas al vuelo, incluida la comprobaci\u00f3n del umbral del acelerador. Esto permite un despegue inmediato con alto empuje si se eleva la palanca del acelerador, lo que lleva a la p\u00e9rdida de control."}], "id": "CVE-2026-26742", "lastModified": "2026-06-17T10:26:18.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26742", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:50:24.469152Z", "version": "2.0.3"}}]}, "published": "2026-03-10T19:17:17.280", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.12.0,1.16.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "px4_drone_autopilot", "vendor": "dronecode"}], "analysis": {"en": {"generated_at": "2026-04-16T10:00:07.252669+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s security patch for PX4 Autopilot versions 1.12.x\u20131.15.x that corrects the Re\u2011arm Grace Period logic.", "If a patch is unavailable, disable the Re\u2011arm Grace Period feature or set its duration to zero so that safety checks are performed before re\u2011arm.", "Enforce pre\u2011flight safety checks manually after re\u2011arm, such as unlocking the throttle threshold check regardless of mode, to recover the safety net.", "Update the PX4 firmware to the latest released version as soon as an official fix is issued."], "summary": {"action": "Patch Immediately", "impact": "Loss of Control"}, "threat_synthesis": {"affected_systems": "The vulnerability affects PX4 Autopilot firmware from version 1.12.x up to 1.15.x. Affected users should verify their installed PX4 version and identify whether it resides within this range.", "description_and_impact": "PX4 Autopilot versions 1.12.x through 1.15.x contain a flaw in the Re\u2011arm Grace Period logic where the system mistakenly applies in\u2011air emergency re\u2011arm rules during ground scenarios. This incorrect permission enforcement flaw (CWE\u2011862) causes the protection mechanism to bypass all pre\u2011flight safety checks, including the critical throttle threshold check, when a pilot switches to Manual mode and re\u2011arms within the default 5\u2011second grace period of an automatic landing. The result is an immediate high\u2011thrust takeoff when the throttle stick is raised, leading to loss of control and potential safety incidents.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.1, indicating high severity, but the EPSS score is below 1\u202f%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need the ability to command a mode switch to Manual during a landing sequence, either through the remote controller or by compromising the aviation system, to trigger the bypass. Once the grace period is exploited, safety checks are circumvented and high\u2011thrust takeoff becomes possible, presenting a direct risk of loss of control."}}}}, "created": "2026-03-11T11:50:45.182534+00:00", "title": "PX4 Autopilot Re\u2011arm Grace Period Logic Bypass Enabling Immediate Takeoff and Loss of Control", "updated": "2026-04-16T10:00:14.104144+00:00", "vendors": ["dronecode", "dronecode$PRODUCT$px4_drone_autopilot"]}