RCE in Spaceapplications Yamcs
CVE-2026-46621
Yamcs is a mission control framework. Prior to 5.12.7, the Yamcs script evaluation engine for Python algorithms dynamically compiled and evaluated user-controlled algorithm text using Jython through the JSR-223 ScriptEngine API without enforcing a secure sandbox, so an authenticated user with the ChangeMissionDatabase privilege could override an existing Python algorithm's logic through the mission database REST API and import and execute arbitrary Java classes such as java.lang.Runtime to achieve remote code execution on the underlying host operating system. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.011 (65.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 66th percentile — 65.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: 0.000
Affected products
- Spaceapplications Yamcs
- Yamcs — versions < 5.12.7
Weakness classification (CWE)
References
- github.com/yamcs/yamcs/security/advisories/GHSA-2g95-6x5q-xjwj (Exploit, Vendor Advisory)
- github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011 (Patch)
- github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992 (Patch)
- github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 (Release Notes)
- github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 (Release Notes)
Frequently asked questions
- What is CVE-2026-46621?
- CVE-2026-46621 is a critical-severity vulnerability in Spaceapplications Yamcs, classified under Code Injection. CVSS score: 9.1/10. Published 2026-07-16.
- How severe is CVE-2026-46621?
- Critical severity. CVSS v3 base score is 9.1 out of 10.