# CVE-2026-2675: RTI Connext Professional Missing Authentication in Security Plugins

Source: https://junglewise.ai/threats/cve-2026-2675-rti-connext-professional-missing-authentication-in-security  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-2675 · Severity: info · CVSS 6 · Published 2026-06-17

RTI Connext Professional, a widely used connectivity framework for industrial and mission-critical systems, contains a security flaw in its Security Plugins. This vulnerability allows an attacker to bypass authentication for critical functions, enabling them to spoof or fake the source of data within the system. This could lead to unauthorized commands being accepted as legitimate, potentially compromising the integrity of operations and data in automated environments.

Technologies: [Rti Connext Professional](https://junglewise.ai/threats/technologies/connext-professional). Vendors: [Rti](https://junglewise.ai/threats/vendors/rti).

## Quick answers

**Is CVE-2026-2675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2675 being exploited in the wild.

**How severe is CVE-2026-2675?** Informational severity, with a CVSS score of 6, published 17 June 2026.

**Which products and versions are affected?** Rti Connext Professional 7.4.0 before 7.7.0, 7.0.0 before 7.3.1.3, 6.1.0 before 6.1.*, 6.0.0 before 6.0.*, 5.3.0 before 5.3.*.

**Is there a fix for CVE-2026-2675?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-2675 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2675?** Check whether you run Rti Connext Professional at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Missing Authentication for Critical Function vulnerability (CWE-306) exists in the Security Plugins of RTI Connext Professional. The flaw allows an attacker with low privileges to bypass authentication checks for critical operations, specifically enabling the faking of data sources. The attack vector is network-based and requires low privileges, though it is categorized with a 'Physical' or 'Provable' attack threshold in CVSS 4.0 terminology (AT:P). Successful exploitation allows an attacker to inject high-integrity data as if it originated from a trusted source. Affected versions include various releases across the 5.x, 6.x, and 7.x branches; users are advised to upgrade to the respective fixed versions (e.g., 7.7.0 or 7.3.1.3).

## Affected products

- RTI Connext Professional (Security Plugins) 7.4.0 before 7.7.0, 7.0.0 before 7.3.1.3, 6.1.0 before 6.1.*, 6.0.0 before 6.0.*, 5.3.0 before 5.3.*

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory

## References

- [https://www.rti.com/vulnerabilities/](https://www.rti.com/vulnerabilities/)

## Related threats

- [RTI Connext Professional use-after-free in Security Plugins](https://junglewise.ai/threats/cve-2026-8849-use-after-free-vulnerability-in-rti-connext-professional-security)
- [RTI Connext Professional stack-based buffer overflow in core libraries](https://junglewise.ai/threats/cve-2026-7866-stack-based-buffer-overflow-vulnerability-in-rti-connext)
- [RTI Connext Professional out-of-bounds read in core libraries](https://junglewise.ai/threats/cve-2026-18626-out-of-bounds-read-vulnerability-in-rti-connext-professional-core)
- [RTI Connext Professional integer overflow in Core Libraries](https://junglewise.ai/threats/cve-2026-18462-integer-overflow-or-wraparound-improper-access-control)
- [RTI Connext Professional format string injection in Core Libraries](https://junglewise.ai/threats/cve-2026-18461-use-of-externally-controlled-format-string-vulnerability-in-rti)