Is CVE-2026-27509 actively exploited?

No active exploitation of CVE-2026-27509 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27509 be exploited remotely?

Partially. CVE-2026-27509 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2026-27509?

CVE-2026-27509 has a CVSS score of 8.0 (HIGH).

HOME VULNERABILITIESCVE-2026-27509

HIGH

CVE-2026-27509

CWE-306Published: February 26, 2026· Updated: Feb 27, 2026

8.0

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.7th

Official Description

Unitree Go2 firmware versions V1.1.7 through V1.1.9 and V1.1.11 (EDU) do not implement DDS authentication or authorization for the Eclipse CycloneDDS topic rt/api/programming_actuator/request handled by actuator_manager.py. A network-adjacent, unauthenticated attacker can join DDS domain 0 and publish a crafted message (api_id=1002) containing arbitrary Python, which the robot writes to disk under /unitree/etc/programming/ and binds to a physical controller keybinding. When the keybinding is pressed, the code executes as root and the binding persists across reboots.

NVD Source

Technical Analysis

CVE-2026-27509 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.0.