Is CVE-2026-1579 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1579 being exploited in the wild.

How severe is CVE-2026-1579?

Critical severity, with a CVSS score of 9.8, published 31 March 2026.

Is there a fix for CVE-2026-1579?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-1579 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-1579?

Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1579: PX4 Autopilot missing authentication in MAVLink protocol

CVE-2026-1579 · Severity: critical · CVSS 9.8 · Published 2026-03-31

The PX4 Autopilot system, used in drones and unmanned vehicles, uses a communication protocol that does not require authentication by default. This allows an unauthorized person with network access to the vehicle to send commands, including those that provide full shell access to the system. An attacker could take control of the vehicle, access sensitive data, or disrupt operations.

Technologies: Px4 Autopilot. Vendors: Px4.

Quick answers

Is CVE-2026-1579 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1579 being exploited in the wild.
How severe is CVE-2026-1579?: Critical severity, with a CVSS score of 9.8, published 31 March 2026.
Which products and versions are affected?: Px4 Autopilot v1.16.0 SITL.
Is there a fix for CVE-2026-1579?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-1579 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-1579?: Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The MAVLink communication protocol used in PX4 Autopilot lacks mandatory cryptographic authentication by default (CWE-306). When MAVLink 2.0 message signing is disabled, an unauthenticated attacker with access to the MAVLink interface can inject arbitrary messages. This includes the SERIAL_CONTROL message, which provides interactive shell access to the autopilot system. To mitigate this, users must enable MAVLink 2.0 message signing, which causes the protocol to reject all unsigned messages. The vulnerability is confirmed in PX4 Autopilot v1.16.0 SITL.

Affected products

PX4 Autopilot v1.16.0 SITL

Timeline

2026-03-31: advisory: Initial advisory published by ICS-CERT/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.