Px4 Drone Autopilot
CVE-2026-26742
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAircraft completes automatic landing
-
DeliveryPilot switches to Manual mode within 5 seconds
-
ExploitSystem bypasses pre-flight safety checks
-
ExecutionRaises throttle for immediate high-thrust takeoff
-
ImpactLoss of aircraft control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | PX4 Autopilot versions 1.12.x through 1.15.x with default Re-arm Grace Period set to 5 seconds; attacker must have physical access to transmitter; aircraft must complete automatic landing sequence before mode switch and re-arm within grace period window |
| Impact | CVSS 8.1 (HIGH). Attack vector: Adjacent Network. Complexity: Low. Privileges required: None. User interaction: None. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this flaw, loss of control. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
PX4 Autopilot versions 1.12.x through 1.15.x can be forced into an unsafe re-arm state when pilots switch to Manual mode and re-arm within 5 seconds of landing, bypassing critical pre-flight safety checks and throttle validation. This allows attackers or malicious pilots to trigger immediate high-thrust takeoff, resulting in loss of aircraft control. Public exploit code exists for this vulnerability and no patch is currently available.
Earlier versions of this analysis (1)
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. [CVSS 8.1 HIGH]
RemediationAI
Monitor vendor advisories for a patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-862 (Missing Authorization). Affects Px4 Drone Autopilot. PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading t
Know when Px4 Drone Autopilot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control.
Executive ViewAI
PX4 Autopilot systems (versions 1.12.x-1.15.x) contain a critical logic flaw that could allow unauthorized re-arming of aircraft on the ground, potentially enabling unauthorized takeoff or loss of vehicle control. This affects all organizations operating unmanned aerial systems using affected PX4 versions, with immediate risk to flight safety and operational security.
Disable automated re-arm grace period feature in firmware configuration if available; implement mandatory manual re-arm authorization requiring multi-factor operator confirmation; enforce geofencing restrictions to prevent ground-based takeoffs in non-designated areas; require continuous operator supervision and implement kill-switch procedures; segregate affected systems to controlled test ranges away from populated areas; establish rigorous pre-flight safety checklists and hardware safety interlocks (propeller guards, weight-on-wheels inhibits).
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Related Vulnerabilities in PX4 Autopilot Logic Flaws
View all 2More in Px4 Drone Autopilot
View allPX4-Autopilot provides PX4 flight control solution for drones. Rated critical severity (CVSS 9.8), this vulnerability is
PX4-Autopilot v1.14.3 was discovered to contain a buffer overflow via the topic_name parameter at /logger/logged_topics.
An issue in PX4 Autopilot v.1.14.0 allows an attacker to manipulate the flight path allowing for crashes of the drone vi
A buffer overflow in PX4-Autopilot v1.12.3 allows attackers to cause a Denial of Service (DoS) via a crafted MavLink mes
PX4 Autopilot v.1.14 allows an attacker to fly the drone into no-fly zones by breaching the geofence using flaws in the
A stack-based buffer overflow in PX4-Autopilot (PX4 drone autopilot firmware) up to and including version 1.16.0 allows
An issue in PX4 Autopilot v1.14 and before allows a remote attacker to execute arbitrary code and cause a denial of serv
PX4 autopilot is a flight control solution for drones. Rated medium severity (CVSS 4.3), this vulnerability is remotely
A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows
PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condi
Stack Buffer Overflow in PX4-Autopilot v1.14.3, which allows attackers to execute commands to exploit this vulnerability
Exploit-DB