PX4 Autopilot

aruschman

Mar 31, 2026

Release Date

March 31, 2026

Description

View CSAF

Summary

Successful exploitation of this vulnerability could allow an attacker with access to the MAVLink interface to execute arbitrary shell commands without cryptographic authentication.

The following versions of PX4 Autopilot are affected:

Autopilot v1.16.0_SITL_latest_stable (CVE-2026-1579)

CVSS Vendor Equipment Vulnerabilities

v3 9.8 PX4 PX4 Autopilot Missing Authentication for Critical Function

Background

Critical Infrastructure Sectors: Transportation Systems, Emergency Services, Defense Industrial Base

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Switzerland

Vulnerabilities

Expand All +

CVE-2026-1579

The MAVLink communication protocol does not require cryptographic authentication by default.…