What is the CVSS score of CVE-2026-44596?

CVE-2026-44596 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-44596?

Yes, a public proof-of-concept exploit is available for CVE-2026-44596. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-44596?

Within 24 hours: Identify all systems running Yamcs and document current versions; implement immediate compensating controls such as WAF or reverse proxy rate limiting on the POST /auth/token endpoint (target: 5 requests per IP per second), and enable account lockout policies if configurable. Within 7 days: Develop and test upgrade plan to Yamcs 5.12.7 in a non-production environment, verifying compatibility with existing mission-critical processes. Within 30 days: Execute phased deployment of Yamcs 5.12.7 across all production instances, with full monitoring and rollback procedures in place.

Yamcs CVE-2026-44596

Q: Which versions of Yamcs are affected by CVE-2026-44596?

Yamcs mission control systems before version 5.12.7 lack brute-force protection on the authentication endpoint, and publicly available exploit code exists, enabling unauthenticated attackers to…. A patch is available.

EUVD-2026-44956 CRITICAL

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2026-05-27 https://github.com/yamcs/yamcs

GHSA-w5r6-mcgq-7pq4

Java Information Disclosure

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Yamcs HTTP port 8090
Delivery

Target /auth/token with known username
Exploit

Loop password-guess POST requests unthrottled
Execution

Receive valid token on hit
Persist

Authenticate to mission control
Impact

Access/command spacecraft operations

Vulnerability Assessment

Weakness	CWE CWE-307 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Brute-force prevention, rate limiting
Exploitation Conditions	Exploitation requires only network reachability to the Yamcs HTTP server (default port 8090) and its POST /auth/token endpoint using the password grant type - the missing-rate-limit condition is present by default in all versions before 5.12.7, since throttling did not exist and the docs offered no way to enable it. No authentication, user interaction, or special configuration is needed to send the guessing requests (AV:N/AC:L/PR:N/UI:N). The key LIMITING factor is that actual account compromise depends on a guessable, weak, or default credential existing on a valid username; strong, unique passwords or an external IdP with its own lockout blunt the attack, and instances not exposed beyond a trusted management network are not reachable by remote attackers.
Impact	The signals conflict sharply and warrant scrutiny. The published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H), but that vector overstates direct impact: this flaw does not itself disclose data or execute code - it merely removes a rate-limiting control, so any compromise is conditional on successfully guessing a weak or default credential. Supporting the lower-risk reading, EPSS is only 0.05% (17th percentile) and the CVE is NOT in CISA KEV, indicating no confirmed active exploitation. Counterbalancing that, publicly available exploit code exists (Exploit-DB 52605) and the PoC demonstrates trivial exploitation (20 attempts in 0.07s), so the barrier to attempting brute force is essentially zero. Net: treat this as a real hardening priority for internet-exposed Yamcs instances - especially where default accounts like 'operator' or weak passwords are in use - but the honest severity is materially lower than 9.8 because success depends on credential strength, not on the flaw alone. Verify: the C:H/I:H/A:H rating assumes a guessed account grants full control, which is not intrinsic to the missing-throttle weakness.
Exploit ScenarioDerived	An attacker who can reach the Yamcs HTTP port scripts a loop of POST /auth/token requests against a known or default username (e.g. 'operator'), cycling through a password dictionary as shown in the public PoC that fired 20 attempts in 0.07 seconds with no HTTP 429. Because AV:N/AC:L/PR:N/UI:N applies to the request itself, the guessing is unauthenticated and unthrottled; if any account uses a weak or default password, the attacker eventually receives a valid token and gains that account's mission-control access. Public exploit code is available on Exploit-DB (52605).

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 17, 2026

Missing brute-force protection in Yamcs (Yet Another Mission Control System) before 5.12.7 lets unauthenticated remote attackers submit unlimited password-guessing requests to the POST /auth/token endpoint in yamcs-core, which enforces no rate limiting, account lockout, or throttling (CWE-307). Publicly available exploit code exists (Exploit-DB 52605), though EPSS estimates real-world exploitation probability at only 0.05% (17th percentile) and the flaw is not listed in CISA KEV. The upstream fix (5.12.7) introduces a per-IP request cap defaulting to 5 auth requests per second.

Earlier versions of this analysis (1)

v1 May 27, 2026 - 00:30 CVSS 6.5

Unlimited credential brute-forcing is possible against Yamcs (yamcs-core < 5.12.7) because the POST /auth/token OAuth2 password-grant endpoint in AuthHandler.java enforces no rate limiting, account lockout, or failed-attempt throttling by default. Unauthenticated remote attackers can submit unlimited password guesses at machine speed - a publicly available proof-of-concept included in the advisory demonstrates 20 attempts completing in 0.07 seconds with zero HTTP 429 responses. CVSS signals AV:N/AC:L/PR:N/UI:N confirm this is trivially exploitable against any network-reachable Yamcs instance with no special prerequisites; in mission control contexts, a compromised account carries operational risk well beyond what the medium CVSS score alone conveys.

RemediationAI

Vendor-released patch: upgrade yamcs-core to 5.12.7 (or 5.13.0), which adds per-IP authentication rate limiting via the new maxAuthRequestsPerSecond HTTP server option (default 5 requests/second) and returns HTTP 429 on excess; see the advisory at https://github.com/yamcs/yamcs/security/advisories/GHSA-w5r6-mcgq-7pq4 and fix commit https://github.com/yamcs/yamcs/commit/309218c651680f79df11a8d0f8628f7033f98a83 with release https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.7. If immediate upgrade is not possible, place the /auth/token endpoint behind a reverse proxy or WAF that enforces request rate limits and IP-based throttling (note: this shifts correct client-IP handling to the proxy and requires trusting X-Forwarded-For), restrict network access to the Yamcs HTTP port (default 8090) to trusted management networks or VPN rather than exposing it to the internet, and enforce strong non-default passwords plus account lockout at the identity-provider level while rotating known default accounts such as 'operator'. These controls reduce brute-force feasibility but do not replace the throttling the patch provides.

Affected VersionsENISA

yamcs < 5.12.7

Affected Packages

maven org.yamcs:yamcs-core fix: 5.12.7

euvd yamcs fix: 5.12.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Yamcs is an open-source Java-based mission control system used to command and monitor spacecraft, satellites, and other remote payloads. The vulnerable component is the HTTP authentication layer in yamcs-core (Maven package org.yamcs:yamcs-core), specifically AuthHandler.handleToken() in AuthHandler.java, which serves OAuth-style password grant tokens via POST /auth/token backed by the SecurityStore login flow. The root cause is CWE-307 (Improper Restriction of Excessive Authentication Attempts): the handler passed every request straight to getSecurityStore().login() with no throttle, failed-attempt counter, CAPTCHA, or lockout, and neither the quickstart nor documentation guided operators to add such controls. The patch adds a new IP_LIMIT_CACHE with a per-IP counter, a configurable maxAuthRequestsPerSecond option (default 5), a HandlerContext fix to correctly parse the first X-Forwarded-For hop, and a new TooManyRequestsException that returns HTTP 429.

Know when Java gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 4.8 MEDIUM

Endpoint is remote and unauthenticated (AV:N/PR:N/UI:N), but compromise requires guessing a weak credential (AC:H) and the flaw itself only facilitates conditional, partial account access (C:L/I:L/A:N), not the vendor's C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Jul 17, 2026 - 18:52 NVD

MEDIUM CRITICAL

CVSS changed

Jul 17, 2026 - 18:52 NVD

6.5 (MEDIUM) 9.8 (CRITICAL)

DescriptionNVD

Summary

The authentication endpoint POST /auth/token in yamcs-core lacks any form of rate limiting, account lockout, or failed attempt throttling. As a result, an unauthenticated remote attacker can perform unlimited password guessing attempts against any user account.

This missing rate limiting vulnerability (CWE-307) significantly increases the risk of successful brute-force attacks.

Root Cause

File: yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java

POST /auth/token has no rate limiting, no lockout after failed attempts, and no CAPTCHA. The handler processes unlimited authentication requests without any throttling mechanism:

java

// AuthHandler.java - handleToken()
// No throttle, no failed attempt counter, no lockout
private void handleToken(HandlerContext ctx) {
    ...
    getSecurityStore().login(token).whenComplete((info, err) -> {
        // Directly attempts authentication with no rate check
    });
}

This is absent by default - the official quickstart and documentation contain no guidance on configuring rate limiting.

Impact

An attacker can make unlimited authentication attempts against any account. This enables efficient brute-force attacks against any account.

Proof of Concept

bash

# 20 attempts - zero rate limiting
for i in $(seq 1 20); do
  curl -s -o /dev/null -w "Attempt $i: HTTP %{http_code}\n" \
    -X POST "http://TARGET:8090/auth/token" \
    -d "grant_type=password&username=operator&password=operator12$i"
done
# All return HTTP 401 - no HTTP 429 ever

Confirmed: 20 attempts in 0.07 seconds, no rate limiting enforced.

Fix

Implement DRF-style throttling on /auth/token:

java

// Track failed attempts per IP
private static final Cache<String, Integer> FAILED_ATTEMPTS =
    CacheBuilder.newBuilder().expireAfterWrite(15, TimeUnit.MINUTES).build();

private static final int MAX_ATTEMPTS = 10;

private void handleToken(HandlerContext ctx) {
    String ip = ctx.getRemoteAddress();
    int attempts = Optional.ofNullable(FAILED_ATTEMPTS.getIfPresent(ip)).orElse(0);
    if (attempts >= MAX_ATTEMPTS) {
        throw new TooManyRequestsException("Rate limit exceeded");
    }
    // ... existing auth logic
    // On failure: FAILED_ATTEMPTS.put(ip, attempts + 1)
}

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 maven packages depend on org.yamcs:yamcs-core (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 5.12.7.

Articles & Coverage 1

POC CVE-2026-44596: YAMCS yamcs-core < 5.12.7 Allows Unlimited Brute Force on Authentication Endpoint May 29, 2026

Executive ViewAI

Why It Matters

Yamcs mission control systems before version 5.12.7 lack brute-force protection on the authentication endpoint, and publicly available exploit code exists, enabling unauthenticated attackers to conduct unlimited password-guessing attacks. While real-world exploitation probability is low (0.1%), successful compromise would grant unauthorized access to mission-critical systems. Organizations running Yamcs should prioritize patching to prevent potential operational disruption.

Business Impact: High

Compensating Controls

Apply vendor patch: Yamcs 5.12.7 or later. Interim controls if immediate patching is not possible: WAF or reverse proxy rate limiting on POST /auth/token endpoint (5 requests per IP per second); network-based access restrictions to authentication endpoint; enforcement of strong password policies and multi-factor authentication if supported.

Threat Intelligence Overview

EPSS Score

0.1%

Top 83% exploitable

Prevalence

Low

niche open-source spacecraft/satellite mission-control software, aerospace industry only

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS GHSA

Exploit-DB

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.