Is CVE-2026-55548 actively exploited?

No active exploitation of CVE-2026-55548 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-55548 be exploited remotely?

Yes. CVE-2026-55548 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-55548?

CVE-2026-55548 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-55548

MEDIUM

CVE-2026-55548

CWE-284Published: July 16, 2026· Updated: Jul 20, 2026

4.3

CVSS v3.1

EPSS:0.21%probability of exploitation in 30 daysPercentile:11.8th

Official Description

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

NVD Source

Technical Analysis

CVE-2026-55548 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.