# CVE-2026-46562: Yamcs remote code execution in Nashorn ScriptEngine

Source: https://junglewise.ai/threats/cve-2026-46562-yamcs-remote-code-execution-in-nashorn-scriptengine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46562 · Severity: critical · CVSS 9.8 · Published 2026-07-16

Yamcs is a mission control framework used for monitoring and controlling remote systems, such as satellites or spacecraft. A security flaw allows an attacker to execute arbitrary commands on the server hosting the framework. This could lead to a total system takeover, unauthorized access to mission data, and disruption of critical operations.

Technologies: [org.yamcs:yamcs-core (Maven)](https://junglewise.ai/threats/technologies/org-yamcs-yamcs-core), [Yamcs](https://junglewise.ai/threats/technologies/yamcs). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Yamcs](https://junglewise.ai/threats/vendors/yamcs).

## Quick answers

**Is CVE-2026-46562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46562 being exploited in the wild.

**How severe is CVE-2026-46562?** Critical severity, with a CVSS score of 9.8, published 16 July 2026.

**Which products and versions are affected?** org.yamcs:yamcs-core (Maven) < 5.12.7, ECOSYSTEM:introduced=0,fixed=5.12.7; Yamcs < 5.12.7, < 5.13.0, >= 4.7.3, < 5.12.7.

**Is there a fix for CVE-2026-46562?** Yes. org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46562 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46562?** Check whether you run org.yamcs:yamcs-core (Maven) or Yamcs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.yamcs:yamcs-core (Maven): upgrade to 5.12.7 or later

  ```sh
  # set org.yamcs:yamcs-core to 5.12.7 in your pom.xml or build.gradle
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in Yamcs due to the insecure configuration of the Nashorn ScriptEngine in ScriptAlgorithmExecutorFactory.java. The engine was constructed without a ClassFilter, allowing JavaScript to access arbitrary Java classes such as java.lang.Runtime. An attacker with ChangeMissionDatabase privileges can exploit this via the MdbOverrideApi.updateAlgorithm endpoint. In default configurations lacking a security.yaml file, the guest user is granted superuser privileges, making the vulnerability exploitable without authentication. The issue is addressed in versions 5.12.7 and 5.13.0 by disabling algorithm editing by default.

## Affected products

- Yamcs Yamcs < 5.12.7, < 5.13.0

## Identifiers

- CVE-2026-46562
- GHSA-vmwp-vh32-rj75

## Timeline

- 2026-05-21: patched: Fixes released in versions 5.12.7 and 5.13.0
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011](https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011)
- [https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992](https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7)
- [https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0](https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0)
- [https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75](https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75)

## Related threats

- [Yamcs DOM XSS in Extension Routing](https://junglewise.ai/threats/cve-2026-55566-yamcs-dom-xss-in-extension-routing)
- [Yamcs remote code execution via unescaped StreamSQL LIKE pattern](https://junglewise.ai/threats/cve-2026-55565-yamcs-remote-code-execution-via-unescaped-streamsql-like-pattern)
- [Yamcs remote code execution via YAML injection in instance template](https://junglewise.ai/threats/cve-2026-55559-yamcs-remote-code-execution-via-yaml-injection-in-instance)
- [Yamcs unauthenticated directory traversal](https://junglewise.ai/threats/cve-2026-55552-yamcs-unauthenticated-directory-traversal)
- [Yamcs reflected XSS in authorize endpoint](https://junglewise.ai/threats/cve-2026-55549-yamcs-reflected-xss-in-authorize-endpoint)