Which versions of RTI Connext Professional are affected by CVE-2026-7300?

RTI Connext Professional Web Integration Service contains a high-severity vulnerability (CVSS 8.8) allowing unauthenticated attackers to disrupt service and access partial data, with no vendor patch…

How to fix or mitigate CVE-2026-7300?

Within 24 hours: Identify all systems running RTI Connext Professional versions 7.0.0 through 7.3.1.2, 6.1.2, and earlier; enable detailed logging for Web Integration Service access. Within 7 days: Deploy firewall rules restricting Web Integration Service network access to authorized systems only; implement monitoring and alerting for abnormal connection patterns. Within 30 days: Contact RTI to confirm patched versions and timeline; test and deploy patches to all affected systems once available; evaluate business continuity alternatives if patch timeline exceeds acceptable risk window.

RTI Connext Professional CVE-2026-7300

Q: What is the CVSS score of CVE-2026-7300?

CVE-2026-7300 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-17 RTI

Buffer Overflow Connext Professional

8.8

CVSS 4.0 · Vendor: RTI

Severity by source

Vendor (RTI) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Web Integration Service is network-reachable with no auth or user interaction; overflow yields a service crash (A:H) with limited memory disclosure/corruption (C:L/I:L), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (RTI).

CVSS VectorVendor: RTI

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 18:06 vuln.today

DescriptionCVE.org

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in RTI Connext Professional (Web Integration Service) allows Filter Failure through Buffer Overflow.This issue affects Connext Professional: from 7.4.0 before 7.*, from 7.0.0 before 7.3.1.3, from 6.1.2 before 6.1.*.

AnalysisAI

Remote denial of service and partial data exposure in RTI Connext Professional's Web Integration Service results from a classic buffer overflow (CWE-120) reachable over the network without authentication. Versions 7.4.0 before 7.x, 7.0.0 before 7.3.1.3, and 6.1.2 before 6.1.x are vulnerable, and no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high availability impact with low confidentiality and integrity impact, consistent with a filter-failure overflow that crashes the service rather than yielding full code execution.

Technical ContextAI

RTI Connext Professional is a Data Distribution Service (DDS) middleware platform widely used in real-time and mission-critical systems (defense, robotics, autonomous vehicles, medical devices). The vulnerable component is the Web Integration Service, which bridges DDS topics to web clients over HTTP/WebSocket. CWE-120 (Classic Buffer Overflow) indicates that input data is copied into a fixed-size buffer without proper length validation; the description characterizes the consequence as 'Filter Failure through Buffer Overflow', meaning oversized input bypasses a filter check and corrupts adjacent memory in the parsing path.

RemediationAI

Upgrade RTI Connext Professional to 7.3.1.3 or later on the 7.0-7.3 branch, and to the fixed 6.1.x or 7.4.x maintenance release as published by RTI per https://www.rti.com/vulnerabilities/#cve-2026-7300 (Vendor-released patch: 7.3.1.3 for the 7.0-7.3 line; consult the advisory for exact 6.1.x and 7.4.x fix builds). Until patching is possible, restrict network reachability of the Web Integration Service to trusted management VLANs by firewalling its listener port, place it behind an authenticating reverse proxy or WAF that enforces request-size limits on the affected endpoints, and disable or unload the Web Integration Service if it is not in active use - accepting the trade-off that web-based DDS clients will lose connectivity. Monitor the service for unexpected restarts or crash dumps as a high-signal indicator of exploitation attempts.