CVE-2026-55511 yamcs CVE debrief

Who should care

Defenders responsible for the security of Yamcs-based systems should assess exposure and apply remediation to prevent potential exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the integrity of mission data and credentials, as well as prevent potential telemetry tampering or denial of service.

Why it matters

A critical vulnerability in Yamcs allows a user with SystemPrivilege.ControlArchiving to execute arbitrary Java code in the Yamcs server process, potentially leading to severe consequences. Defenders should assess exposure and apply remediation to prevent exploitation.

• Exposure of mission data and credentials
• Potential telemetry tampering or denial of service
• Elevation of privileges for users with SystemPrivilege.ControlArchiving
• Possible disruption of critical mission operations

Technical summary

The vulnerability is caused by the lack of proper sanitization of user-input data in the StreamSQL functionality of Yamcs. This allows an attacker to inject arbitrary Java code, which can then be executed in the context of the Yamcs server process. A user with SystemPrivilege.ControlArchiving can create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCode_InputDefVars and Expression.sanitizeName. A sum aggregate reaches yamcs-core/src/main/java/org/yamcs/yarch/streamsql/CompilableAggregateExpression.java and yamcs-core/src/main/java/org/yamcs/yarch/streamsql/funct/SumExpression.java through SelectExpression.compile, where Janino SimpleCompiler.cook POST /

Defensive priority

High priority should be given to assessing exposure and applying remediation, as the vulnerability can have severe consequences.

Recommended defensive actions

• Assess exposure by checking if the system has the vulnerable version of Yamcs and if the user role with SystemPrivilege.ControlArchiving exists and is used.
• Apply remediation by upgrading to a fixed version of Yamcs (5.12.8 or 5.13.2) or applying compensating controls to restrict access to the vulnerable functionality.
• Verify the effectiveness of the remediation by testing the vulnerability in a controlled environment.
• Monitor for potential exploitation attempts and anomalous activity that may indicate compromise.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by the lack of proper sanitization of user-input data in the StreamSQL functionality of Yamcs. This allows an attacker to inject arbitrary Java code, which can then be executed in the context of the Yamcs server process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.