CISA Issues High-Severity Alert for Critical PX4 Autopilot Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has released a high-priority alert regarding a severe vulnerability in the PX4 Autopilot system, a widely used open-source flight control software for drones and unmanned aerial vehicles (UAVs). Tracked as CVE-2026-1579, the flaw carries a CVSS score of 9.8, indicating a near-maximum risk level.
The vulnerability stems from a "Missing Authentication for Critical Function" error in the software’s MAVLink interface a messaging protocol that facilitates communication between drones and ground control stations. Attackers with access to the MAVLink interface can exploit this weakness to bypass security checks, execute arbitrary shell commands, and hijack drone operations without authentication.
The flaw specifically affects PX4 Autopilot version v1.16.0_SITL_latest_stable and poses significant risks to critical infrastructure sectors, including transportation, emergency services, and defense operations. A successful exploit could lead to data theft, disrupted emergency responses, or compromised military and industrial drone activities.
Discovered by security researcher Dolev Aviv of Cyviation, the vulnerability was detailed in CISA advisory ICSA-26-090-02, published on March 31, 2026. Until a patch is released, organizations are advised to restrict MAVLink access to trusted networks to mitigate exposure.
Drone operators and entities relying on PX4 Autopilot are urged to monitor official updates and implement defensive measures to secure their systems.
Source: https://gbhackers.com/critical-px4-autopilot-vulnerability/
PX4 Autopilot TPRM report: https://www.rankiteo.com/company/px4
"id": "px41775118433",
"linkid": "px4",
"type": "Vulnerability",
"date": "3/2026",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'customers_affected': 'Transportation, emergency '
'services, defense operations',
'industry': 'Aviation/Drone Technology',
'name': 'PX4 Autopilot (open-source project)',
'type': 'Software'}],
'attack_vector': 'MAVLink interface (network access)',
'customer_advisories': 'Drone operators and entities relying on PX4 Autopilot '
'are urged to monitor official updates and implement '
'defensive measures.',
'data_breach': {'type_of_data_compromised': 'Potential data theft'},
'date_publicly_disclosed': '2026-03-31',
'description': 'The Cybersecurity and Infrastructure Security Agency (CISA) '
'has released a high-priority alert regarding a severe '
'vulnerability in the PX4 Autopilot system, a widely used '
'open-source flight control software for drones and unmanned '
'aerial vehicles (UAVs). The vulnerability, tracked as '
'CVE-2026-1579, carries a CVSS score of 9.8, indicating a '
"near-maximum risk level. The flaw stems from a 'Missing "
"Authentication for Critical Function' error in the software’s "
'MAVLink interface, allowing attackers to bypass security '
'checks, execute arbitrary shell commands, and hijack drone '
'operations without authentication.',
'impact': {'data_compromised': 'Potential data theft',
'operational_impact': 'Disrupted emergency responses, compromised '
'military and industrial drone activities',
'systems_affected': 'Drones and UAVs using PX4 Autopilot '
'v1.16.0_SITL_latest_stable'},
'post_incident_analysis': {'root_causes': 'Missing Authentication for '
'Critical Function in MAVLink '
'interface'},
'recommendations': 'Restrict MAVLink access to trusted networks, monitor '
'official updates for patch',
'references': [{'date_accessed': '2026-03-31', 'source': 'CISA Advisory'},
{'source': 'Cyviation (Security Researcher: Dolev Aviv)'}],
'regulatory_compliance': {'regulatory_notifications': 'CISA advisory '
'ICSA-26-090-02'},
'response': {'containment_measures': 'Restrict MAVLink access to trusted '
'networks',
'remediation_measures': 'Monitor official updates for patch'},
'title': 'CISA Issues High-Severity Alert for Critical PX4 Autopilot '
'Vulnerability',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-1579 (Missing Authentication for '
'Critical Function)'}