CVE-2026-55565 yamcs CVE debrief

Who should care

Defenders responsible for Yamcs deployments, particularly those using versions prior to 5.12.8 and 5.13.2, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-55565 is a critical vulnerability in Yamcs that allows Java code injection through unescaped LIKE patterns. Defenders should prioritize verifying exposure in systems using Yamcs versions prior to 5.12.8 and 5.13.2, and assess the feasibility of injecting malicious Java code. The vulnerability can be exploited through various API endpoints and activity searches, and defenders should implement compensating controls to monitor and restrict Java code execution.

• Potential Java code injection through user-input LIKE patterns
• Possible exploitation through multiple API endpoints and activity searches
• Need for verification of system exposure and configurations
• Priority for updating to fixed Yamcs versions

Technical summary

The LikeExpression.fillCode_getValueReturn method in Yamcs inserts unescaped LIKE patterns into Java source code, allowing potential Java code injection. The vulnerability affects Yamcs versions prior to 5.12.8 and 5.13.2, and can be exploited through various API endpoints and activity searches, including POST /api/archive/{instance}:executeSql, POST /api/archive/{instance}:streamSql, POST /api/archive/{instance}/tables/{table}:readRows, GET /api/archive/{instance}/events, or activity searches. Defenders should prioritize verifying exposure in systems using Yamcs versions prior to 5.12.8 and 5.13.2, and assess the feasibility of injecting malicious Java code through user-input LIKE patterns.

Defensive priority

Defenders should prioritize verifying exposure in systems using Yamcs versions prior to 5.12.8 and 5.13.2, and assess the feasibility of injecting malicious Java code through user-input LIKE patterns.

Recommended defensive actions

• Verify system exposure by checking Yamcs versions and configurations
• Assess user input validation and sanitization for LIKE patterns
• Implement compensating controls to monitor and restrict Java code execution
• Update to Yamcs versions 5.12.8 or 5.13.2
• Review system logs for suspicious activity
• Perform a thorough review of system configurations and user inputs
• Isolate affected systems until patched

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Yamcs, including affected versions and potential attack vectors. However, the corpus does not establish concrete evidence of exploitation or specific business impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.