Security readout for executives and security teams
Plain-English summary
A remote attacker may take control of vulnerable Yamcs mission-control servers by supplying crafted instance settings. Unsecured deployments are especially exposed because guest access can receive superuser capability. Successful exploitation runs commands with the Yamcs service account, potentially compromising sensitive data, configurations, and service availability.
Executive priority
Prioritize immediate remediation for internet-accessible or unsecured Yamcs systems. Schedule rapid upgrades for all other affected deployments because a privileged account could still achieve command execution. If compromise is suspected, isolate the service and initiate incident response before returning it to operation.
Technical view
Yamcs interpolates createInstance and updateInstance template arguments into YAML without context-appropriate escaping. The resulting configuration can introduce an org.yamcs.ProcessRunner service, producing command execution when Yamcs parses and loads the instance. The vulnerable interfaces are POST /api/instances and PATCH /api/instances/{instance}.
Likely exposure
Yamcs versions below 5.12.8 and versions 5.13.0 through 5.13.1 are affected. Without security.yaml, guest superuser access exposes the operation remotely. Secured deployments remain exposed to accounts holding SystemPrivilege.CreateInstances. Network accessibility of the instance-management API materially increases risk.
Exploitation context
The CVSS 3.1 score is 9.8, reflecting network-reachable, low-complexity execution without credentials on unsecured deployments. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Authenticated abuse remains possible where CreateInstances is granted.
Researcher notes
The reported trust-boundary failure occurs in VarStatement.append before YamcsServer.createInstance parses and YamcsServerInstance loads the rendered YAML. The named injection target is the services configuration using org.yamcs.ProcessRunner. The listed fixes are commits 549f295 and 7192da1. No exploit procedure or observed attack campaign is established by the supplied sources.
Mitigation direction
- Upgrade Yamcs 5.12 deployments to 5.12.8 or later.
- Upgrade Yamcs 5.13 deployments to 5.13.2 or later.
- Ensure security.yaml is configured; do not expose guest superuser operation.
- Restrict SystemPrivilege.CreateInstances to essential administrators until upgrades are complete.
- Limit network access to instance-management interfaces while remediation is pending.
Validation and detection
- Inventory every Yamcs deployment and record its exact version.
- Confirm security.yaml exists and guest users lack superuser capability.
- Review which accounts possess SystemPrivilege.CreateInstances and remove unnecessary grants.
- Review available audit records for unexpected instance creation or modification requests.
- Investigate unexplained processes running under the Yamcs service account.
- After upgrading, confirm each deployment reports a fixed or later version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-470: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-55559 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9GitHub_MVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/yamcs/yamcs/security/advisories/GHSA-73mf-m39p-wpm9CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/yamcs/yamcs/commit/549f295cf8c5496a5e799d6bec2432ef976c82aaCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/yamcs/yamcs/commit/7192da1c49bdf5ab1d72e579a47766a7c43e87c8CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.12.8CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/yamcs/yamcs/releases/tag/yamcs-5.13.2CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.