What is the CVSS score of CVE-2026-26742?

CVE-2026-26742 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Px4 Drone Autopilot are affected by CVE-2026-26742?

PX4 Autopilot systems (versions 1.12.x-1.15.x) contain a critical logic flaw that could allow unauthorized re-arming of aircraft on the ground, potentially enabling unauthorized takeoff or loss of…

Is there a public PoC exploit available for CVE-2026-26742?

Yes, a public proof-of-concept exploit is available for CVE-2026-26742. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26742?

Within 24 hours: Inventory all PX4 Autopilot deployments and identify systems running versions 1.12.x through 1.15.x; restrict flight operations for affected systems to supervised, isolated test environments only. Within 7 days: Contact PX4 vendor for patch availability and timeline; evaluate alternative autopilot platforms or older/newer PX4 versions not affected by this vulnerability. Within 30 days: Implement comprehensive re-arm authorization controls (manual override enforcement, GPS-based geofencing, operator authentication), deploy firmware updates when available, and conduct full regression testing before resuming normal operations.

Px4 Drone Autopilot CVE-2026-26742

HIGH

Missing Authorization (CWE-862)

2026-03-10 cve@mitre.org

Authentication Bypass Px4 Drone Autopilot

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 12, 2026 - 17:05 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 19:17 nvd

HIGH 8.1

DescriptionCVE.org

PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control.

AnalysisAI

PX4 Autopilot versions 1.12.x through 1.15.x can be forced into an unsafe re-arm state when pilots switch to Manual mode and re-arm within 5 seconds of landing, bypassing critical pre-flight safety checks and throttle validation. This allows attackers or malicious pilots to trigger immediate high-thrust takeoff, resulting in loss of aircraft control. Public exploit code exists for this vulnerability and no patch is currently available.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Px4 Drone Autopilot. PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading t