Is CVE-2026-86097 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86097 being exploited in the wild.

How severe is CVE-2026-86097?

Medium severity, with a CVSS score of 6.5, published 4 September 2026.

Is there a fix for CVE-2026-86097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86097 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-86097?

Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86097: PX4 Autopilot null pointer dereference in param_set_default_file

CVE-2026-86097 · Severity: medium · CVSS 6.5 · Published 2026-09-04

PX4 Autopilot is flight control software used on unmanned aerial vehicles and robotics platforms to manage autonomous navigation and operations. A null pointer dereference vulnerability allows an attacker to crash the autopilot process by executing specific commands without proper arguments, potentially disrupting vehicle operation or mission-critical functions.

Technologies: Px4 Autopilot. Vendors: Px4.

Quick answers

Is CVE-2026-86097 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86097 being exploited in the wild.
How severe is CVE-2026-86097?: Medium severity, with a CVSS score of 6.5, published 4 September 2026.
Which products and versions are affected?: Px4 Autopilot through 1.17.0.
Is there a fix for CVE-2026-86097?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86097 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-86097?: Check whether you run Px4 Autopilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference vulnerability exists in the param_set_default_file() and param_set_backup_file() functions in PX4 Autopilot. The vulnerability is triggered when the 'param select' or 'param select-backup' commands are invoked from the PX4 shell without providing a required path argument, causing the functions to dereference a null pointer. An attacker with shell access can exploit this to crash the autopilot process, resulting in denial of service. The vulnerability affects versions through 1.17.0; patch status for newer versions is not specified in available information.

Affected products

PX4 Autopilot through 1.17.0

Timeline

2026-09-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.