CVE-2026-55547 yamcs CVE debrief

Who should care

Defenders and administrators of systems using Yamcs should assess exposure and potential impact, focusing on versions prior to 5.12.8 and 5.13.2. They should verify exposure, assess potential impact, and apply patches or updates to affected systems. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra

Why it matters

CVE-2026-55547 allows authenticated accounts to enumerate available system privileges and configured role mappings in Yamcs versions prior to 5.12.8 and 5.13.2, potentially supporting targeted privilege-escalation attempts. Defenders should verify exposure, assess potential impact, and apply patches or updates to affected systems.

• Privilege enumeration may support targeted privilege-escalation attempts
• Verify exposure and assess potential impact on systems using affected versions
• Apply patches or updates to affected systems to prevent exploitation

Technical summary

Yamcs versions prior to 5.12.8 and 5.13.2 omit SystemPrivilege.ControlAccess checks in IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges, allowing authenticated accounts to enumerate available system privileges and configured role mappings. This issue could potentially support targeted privilege-escalation attempts. The vulnerability is fixed in versions 5.12.8 and 5.13.2. Official source records and references are required for further verification. The CVE record and source references indicate that Yamcs versions prior to 5.12.8 and 5.13.2 are affected by a privilege enumeration issue.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using Yamcs versions prior to 5.12.8 and 5.13.2.

Recommended defensive actions

• Verify Yamcs version and check for exposure
• Assess potential impact on systems using affected versions
• Apply patches or updates to affected systems
• Monitor system privileges and role mappings
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references indicate that Yamcs versions prior to 5.12.8 and 5.13.2 are affected by a privilege enumeration issue. Official source records and references are required for further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.