Is CVE-2026-1442 actively exploited?

No active exploitation of CVE-2026-1442 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1442 be exploited remotely?

No. CVE-2026-1442 requires local access to exploit.

What is the CVSS score of CVE-2026-1442?

CVE-2026-1442 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-1442

HIGH

CVE-2026-1442

CWE-321Published: February 27, 2026· Updated: Feb 27, 2026

7.8

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:0.5th

Official Description

Since the encryption algorithm used to protect firmware updates is itself encrypted using key material available to an attacker (or anyone paying attention), the firmware updates may be altered by an unauthorized user, and then trusted by a Unitree product, such as the Unitree Go2 and other models. This issue appears to affect all of Unitree’s current offerings as of February 26, 2026, and so should be considered a vulnerability in both the firmware generation and extraction processes. At the time of this release, there is no publicly-documented mechanism to subvert the update process and insert poisoned firmware packages without the equipment owner’s knowledge.

NVD Source

Technical Analysis

CVE-2026-1442 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.