Critical Remote Code Execution in PX4 Autopilot (CVE‑2026‑1579) Threatens Drone‑Based Critical Infrastructure
What It Is – A critical flaw (CVSS 3.0 9.8) in the PX4 Autopilot’s MAVLink interface allows an unauthenticated actor to send a SERIAL_CONTROL message that spawns an interactive shell on the host system. The vulnerability exists when MAVLink 2.0 message signing is not enabled.
Exploitability – The attack requires only network‑level access to the MAVLink interface; proof‑of‑concept code is publicly available and the CVE has been assigned a high CVSS score, indicating active exploitation risk.
Affected Products – PX4 Autopilot v1.16.0_SITL_latest_stable (open‑source UAV flight controller).
TPRM Impact – Organizations that embed PX4 in commercial drones, autonomous delivery fleets, or mission‑critical UAVs (transportation, emergency response, defense) inherit a supply‑chain risk: a compromised third‑party autopilot can be leveraged to hijack aircraft, disrupt services, or exfiltrate data.
Recommended Actions –
- Immediately enable MAVLink 2.0 message signing on all PX4 deployments.
- Conduct an inventory of all third‑party systems using PX4 and verify firmware versions.
- Apply any vendor‑released patches or upgrade to a version where signing is enforced by default.
- Isolate MAVLink interfaces from untrusted networks and enforce strict network segmentation.
- Update third‑party risk assessments to reflect the elevated RCE risk.
Source: CISA Advisory – ICSA‑26‑090‑02