CVE-2026-55552 yamcs CVE debrief

Who should care

Defenders responsible for Yamcs installations, particularly those exposed to untrusted networks, should assess their exposure and prioritize upgrading to version 5.11.13 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify the presence of affected systems, plan for remediation, and implement compensating controls where necessary.

Why it matters

CVE-2026-55552 is a high-severity vulnerability in the Yamcs mission control framework that allows unauthenticated path traversal attacks, potentially disclosing sensitive data. Defenders should prioritize verifying exposure, upgrading to fixed versions, and monitoring for suspicious activity.

• Potential disclosure of sensitive operating-system and application data
• Possible unauthorized access to arbitrary readable host files
• Need for verification of exposure and remediation priority
• Requirement for inventory checks and monitoring of suspicious file access patterns

Technical summary

The StaticFileHandler.locateFile method in Yamcs versions prior to 5.11.13 does not properly normalize and resolve file paths, allowing path traversal attacks. This flaw can be exploited to disclose sensitive operating-system and application data. Affected product deployments should be identified and verified for exposure to untrusted networks. Defenders should prioritize upgrading to version 5.11.13 or later and conduct inventory checks for exposed instances. Monitoring for suspicious file access patterns is also recommended.

Defensive priority

Defenders should prioritize verifying exposure of Yamcs installations to untrusted networks and upgrading to version 5.11.13 or later. Inventory checks and monitoring for suspicious file access patterns are recommended.

Recommended defensive actions

• Verify Yamcs installations are upgraded to version 5.11.13 or later
• Conduct inventory checks for exposed Yamcs instances
• Monitor for suspicious file access patterns
• Restrict access to sensitive files and directories
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, the exact scope of affected systems and potential data exposure require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.