RTI Connext Professional CVE-2026-2675
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable with low privileges, but AT:P condition maps to AC:H; integrity-only impact with no confidentiality or availability effect.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Fake the Source of Data.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.
AnalysisAI
RTI Connext Professional's Security Plugins component allows authenticated network participants to spoof the source identity of DDS (Data Distribution Service) messages due to missing authentication on a critical data-origin verification function (CWE-306). The flaw affects versions spanning 5.3.x through 7.6.x, with a patched release available at 7.7.0 and 7.3.1.3 for the respective branches. An attacker with low-privilege access to the DDS network can falsify the apparent publisher identity of data streams, directly undermining data integrity in safety-critical deployments such as autonomous systems, industrial control, and defense applications where Connext is widely used. No public exploit code has been identified at time of analysis, and it is not listed in the CISA KEV catalog.
Technical ContextAI
RTI Connext Professional is a commercial Data Distribution Service (DDS) middleware implementation widely deployed in real-time, safety-critical systems including autonomous vehicles, aerospace, and industrial automation. The Security Plugins sub-component provides authentication, access control, and cryptographic protection for DDS publish-subscribe communications. CWE-306 (Missing Authentication for Critical Function) indicates that the function responsible for verifying the originating identity of a DDS data publication does not enforce authentication checks, permitting a network participant to craft or relay messages that appear to originate from a different, potentially trusted, DDS publisher. The affected CPE is cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* across multiple major version lines. The CVSS 4.0 vector's AT:P metric confirms that a specific deployment condition - the presence and activation of the Security Plugins component - must be met for the vulnerability to be exploitable.
RemediationAI
The primary fix is to upgrade RTI Connext Professional to version 7.7.0 or 7.3.1.3 depending on the deployed branch, as documented in the vendor advisory at https://www.rti.com/vulnerabilities/#cve-2026-2675. Organizations on end-of-life branches (5.3.x, 6.0.x, 6.1.x) should prioritize migrating to a supported, patched release, as no patch versions for those branches are indicated in the available data. As a compensating control where immediate upgrade is not feasible, restrict DDS network segment access using network-layer controls (e.g., firewall rules, VLAN isolation) to limit which hosts can participate in the DDS domain - this reduces the pool of potential attackers who could exploit the low-privilege network access requirement, though it does not eliminate the underlying authentication flaw. Additionally, operators should audit DDS topic subscriptions and publisher identities at the application layer to detect anomalous data-source behavior. Note that disabling the Security Plugins entirely is not a viable mitigation, as doing so would remove all DDS-level authentication and worsen the security posture.
More in Connext Professional
View allRemote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routin
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routin
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today