CVE-2026-46562: Yamcs remote code execution in Nashorn ScriptEngine

CVE-2026-46562 · Severity: critical · CVSS 9.8 · Published 2026-07-16

Yamcs is a mission control framework used for monitoring and controlling remote systems, such as satellites or spacecraft. A security flaw allows an attacker to execute arbitrary commands on the server hosting the framework. This could lead to a total system takeover, unauthorized access to mission data, and disruption of critical operations.

Technologies: org.yamcs:yamcs-core (Maven), Yamcs. Vendors: Maven, Yamcs.

Quick answers

Is CVE-2026-46562 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46562 being exploited in the wild.
How severe is CVE-2026-46562?
Critical severity, with a CVSS score of 9.8, published 16 July 2026.
Which products and versions are affected?
org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.13.0, >= 4.7.3, < 5.12.7.
Is there a fix for CVE-2026-46562?
Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46562 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46562?
Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later
    # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle

Technical details

A remote code execution (RCE) vulnerability exists in Yamcs due to the insecure configuration of the Nashorn ScriptEngine in ScriptAlgorithmExecutorFactory.java. The engine was constructed without a ClassFilter, allowing JavaScript to access arbitrary Java classes such as java.lang.Runtime. An attacker with ChangeMissionDatabase privileges can exploit this via the MdbOverrideApi.updateAlgorithm endpoint. In default configurations lacking a security.yaml file, the guest user is granted superuser privileges, making the vulnerability exploitable without authentication. The issue is addressed in versions 5.12.7 and 5.13.0 by disabling algorithm editing by default.

Affected products

  • Yamcs Yamcs < 5.12.7, < 5.13.0

Identifiers

  • CVE-2026-46562
  • GHSA-vmwp-vh32-rj75

Timeline

  • 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
  • 2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.