CVE-2026-46562 — Security Box Score

CVE · referencelatest edition

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-46562CRITICAL

Yamcs: Remote Code Execution via Mission Database algorithm override

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0078   53.1     —

AFFECTED
  Product  Versions    Fixed
  yamcs    < 5.12.7 –  —

TIMELINE
  May 14  Reserved by GitHub_M
  Jul 16  EXPLOIT PUBLISHED — CVE-2026-46562 (yamcs). Public exploit reference added.
  Jul 16  Published (CNA: GitHub_M)

CWE-94, CWE-95, CWE-470 · CNA: GitHub_M · CVSS v3.1 · 5 references · NVD status: Analyzed

Description

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the ChangeMissionDatabase privilege could override an algorithm through the MdbOverrideApi.updateAlgorithm endpoint and supply JavaScript that reaches arbitrary Java classes (for example Java.type("java.lang.Runtime").getRuntime().exec(...)) to execute arbitrary OS commands as the Yamcs process; in the default configuration with no security.yaml the built-in guest user has superuser=true, making the issue reachable without authentication. This issue is fixed in versions 5.12.7 and 5.13.0, which disable algorithm editing by default.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
May 14, 2026	Reserved	Reserved by GitHub_M
July 16, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-46562 (yamcs). Public exploit reference added.
July 16, 2026	Published	Published (CNA: GitHub_M)

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
yamcs	yamcs	—	< 5.12.7	—

Weaknesses

CWE-94 · CWE-95 · CWE-470

References (5)

https://github.com/yamcs/yamcs/commit/3c550348f866af4675d2ba4a51d8d12b7c7c6011 [Patch]
https://github.com/yamcs/yamcs/commit/4ff8fda642ea8c3309a4d3f379aa77b763148992 [Patch]
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7 [Release Notes]
https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.0 [Release Notes]
https://github.com/yamcs/yamcs/security/advisories/GHSA-vmwp-vh32-rj75 [Exploit, Vendor Advisory]

Authoritative record: CVE-2026-46562 at cve.org

Vendors: yamcs

Weaknesses: CWE-94 · CWE-95 · CWE-470

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-46562 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.