RTI Connext Professional
CVE-2026-30799
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with low privileges confirmed; AC:H reflects the AT:P attack prerequisite (specific DDS network position and Security Plugin deployment required); no confidentiality impact per VC:N.
Primary rating from Vendor (RTI).
CVSS VectorVendor: RTI
Lifecycle Timeline
1DescriptionCVE.org
Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.*, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.
AnalysisAI
Identity spoofing via missing authentication in RTI Connext Professional's Security Plugins component enables a low-privileged network attacker to impersonate legitimate DDS participants, achieving high integrity and availability impact against affected deployments. Versions spanning five major release lines - 5.3.x through 7.6.x - are affected, with the fix landing at 7.7.0 for the 7.4 branch. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability impacts on a middleware widely used in defense, aerospace, and industrial control systems elevate practical risk above what the moderate CVSS score alone suggests.
Technical ContextAI
RTI Connext Professional is a commercial implementation of the OMG Data Distribution Service (DDS) standard, a publish-subscribe middleware used extensively in real-time distributed systems including autonomous vehicles, military C2, and industrial automation. The Security Plugins component overlays DDS with authentication, access control, and cryptographic services as specified by the DDS-Security standard. CWE-306 (Missing Authentication for Critical Function) indicates that a specific function within the Security Plugins - responsible for validating participant identity - can be invoked without passing an authentication gate, allowing an actor to assert an arbitrary DDS participant identity. The CPE cpe:2.3:a:rti:connext_professional:*:*:*:*:*:*:*:* confirms the affected product family. The CVSS 4.0 AT:P (Attack Requirements: Present) metric indicates that specific preconditions - such as network reachability to DDS discovery endpoints and low-level participant credentials - must be met for exploitation.
RemediationAI
The primary fix is to upgrade RTI Connext Professional to version 7.7.0 or later for users on the 7.4.x branch. For users on earlier release lines (5.3.x, 6.0.x, 6.1.x, 7.0.x-7.2.x), RTI's advisory at https://www.rti.com/vulnerabilities/#cve-2026-30799 should be consulted for the exact patched build within each supported minor line, as the CVE description indicates fixes exist in the respective 5.3.*, 6.0.*, 6.1.*, and 7.3.* patch releases. As a compensating control where immediate patching is not feasible, restrict network access to DDS discovery ports (typically UDP 7400-7500 range) to trusted segments only, reducing the attack surface for the AT:P prerequisite. Additionally, audit whether the Security Plugins component is strictly necessary for all endpoints - disabling it on non-sensitive nodes reduces exposure, though at the cost of losing DDS-Security protections on those nodes. Note that neither workaround eliminates the vulnerability for authenticated insider threat scenarios.
More in Connext Professional
View allRemote heap-based buffer overflow in RTI Connext Professional Core Libraries allows unauthenticated network attackers to
Out-of-bounds read in RTI Connext Professional Core Libraries allows remote unauthenticated attackers to read beyond int
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RTI Connext Profes
Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a
XML External Entity (XXE) injection in RTI Connext Professional's Core Libraries allows remote unauthenticated attackers
XML External Entity (XXE) injection in RTI Connext Professional routing and service components allows remote unauthentic
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in RTI Connext
Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Libraries) allows Pointer Manipulation.4.0
Network traffic sniffing in RTI Connext Professional 7.2.0-7.3.0 and 7.4.0-7.6.x exposes private personal information to
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Routin
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Core L
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today