CVE-2026-55521 yamcs CVE debrief

Who should care

Defenders and administrators of Yamcs mission control framework deployments should assess exposure and apply patches to prevent potential disruptions. They should also review and restrict user privileges to prevent unauthorized actions, monitor system integrity and availability for potential disruptions, and verify exposure by checking current Yamcs version and user privileges.

Why it matters

CVE-2026-55521 is a high-severity vulnerability in the Yamcs mission control framework that allows low-privilege users to perform unauthorized actions, potentially disrupting telecommand handling and system integrity. Defenders should prioritize verifying exposure and applying patches.

• Potential disclosure of telemetry metadata
• Disruption of telecommand handling
• Impact on system integrity and availability

Technical summary

The vulnerability exists in the IndexesApi, Cop1Api, and TimeApi of the Yamcs framework, allowing low-privilege users to perform unauthorized actions. An authenticated low-privilege user can read packet and event index metadata without ObjectPrivilegeType.ReadPacket, alter COP-1 link state without SystemPrivilege.ControlLinks, and manipulate simulation time. These operations can disclose telemetry metadata, disrupt telecommand handling, and affect system integrity and availability. Fixed versions are 5.12.8 and 5.13.2. Defenders should prioritize verifying exposure and applying patches to prevent potential disruptions to telecommand handling and system integrity.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to prevent potential disruptions to telecommand handling and system integrity.

Recommended defensive actions

• Verify exposure by checking current Yamcs version and user privileges
• Apply patches to upgrade to version 5.12.8 or 5.13.2
• Review and restrict user privileges to prevent unauthorized actions
• Monitor system integrity and availability for potential disruptions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, additional information on affected deployments and potential exploitation is limited. Defenders should verify exposure by checking current Yamcs version and user privileges, review system integrity and availability for potential disruptions, and monitor for unauthorized actions. The lack of specific details on affected deployments requires a cautious approach, focusing on preventive measures and readiness.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.