RTI Connext Professional CVE-2026-2675

Exploitation requires that the RTI Connext Professional Security Plugins component is active and configured within the DDS deployment - environments not using Security Plugins are not affected by this CVE. The attacker must have low-privilege network access (PR:L per CVSS 4.0) to the DDS communication domain, meaning they must be a participant or otherwise able to inject DDS traffic into the domain, but do not require administrative or operator-level credentials. No user interaction is required once network access is established. Limiting factors include: the AT:P attack requirement (Security Plugins must be deployed), the need for at least low-level network/domain access preventing fully external unauthenticated exploitation, and the absence of any known public exploit code or active exploitation campaigns at time of analysis.

The CVSS 4.0 score of 6.0 reflects a meaningful but not critical-tier rating: network-reachable (AV:N), low complexity (AC:L), but requiring both low privileges (PR:L) and a specific attack requirement (AT:P - Security Plugins must be active). The sole impact is high integrity loss on the vulnerable system (VI:H) with no confidentiality or availability impact, consistent with a data-spoofing class of flaw. EPSS data was not provided, precluding probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV, and no POC has been identified, suggesting it has not yet seen opportunistic or widespread exploitation. However, the real-world risk in target environments (safety-critical industrial, defense, autonomous systems) is disproportionately high relative to the numeric score: false data injection into DDS pipelines can cause cascading physical-world consequences in systems that consume that data for actuation or decision-making. The AT:P condition (Security Plugins active) is worth noting - environments that have NOT deployed the Security Plugins are not exposed to this specific flaw, though they would also lack DDS-level authentication protections entirely.

An attacker with low-privilege access to the DDS network segment - for example, a rogue device, compromised endpoint, or insider threat on the same network - sends DDS data publications to a topic while falsifying the source participant identity, making the messages appear to originate from a legitimate, trusted publisher. Downstream subscribers consuming that topic accept the forged data as authentic, potentially causing incorrect actuation, false sensor readings, or corrupted state in safety-critical systems. No public exploit code has been identified at time of analysis, but the network-accessible attack surface and low complexity make development of working exploit tooling straightforward for a technically capable adversary.