External risk intelligence

Yamcs SQL Injection Leads to Arbitrary Java Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-55511

Yamcs is a mission control framework typically deployed in specialized, restricted environments rather than as a public-facing web application. While the vulnerable API endpoint is network-reachable, such systems are generally maintained within internal, secured infrastructure, making public internet exposure uncommon.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Yamcs mission control framework that could allow unauthorized execution of arbitrary Java code. This could potentially expose sensitive mission data and credentials, or enable tampering and denial of service. The concern is confirming relevance and exposure.

Code execution flaw in mission control software.
Protects critical mission data and operations.
Confirm impact and manage system updates.

Attack Path

How an attacker could exploit the issue

An attacker with system control privileges could craft a special SQL query to inject malicious Java code. This code is then compiled and executed by the Yamcs server, potentially leading to unauthorized access and manipulation of sensitive mission data.

Requires authenticated system control access.
Triggered by creating a specific SQL query.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a user with SystemPrivilege.ControlArchiving could inject malicious Java code into the Yamcs server process. This could expose sensitive mission data and credentials, allow for tampering with telemetry, or cause a denial of service.

Mission data and credentials could be exposed.
Arbitrary Java code execution on the server.
Telemetry tampering or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this critical vulnerability likely falls to the platform or infrastructure teams managing the Yamcs mission control framework, with input from application owners who rely on its functionality. The immediate priority is to identify all instances of the affected Yamcs versions, confirm their network reachability and business criticality, and then locate the accountable technical owner for each instance to plan remediation.

Platform or infrastructure teams own the issue.
Verify Yamcs instances and exposure.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Yamcs?

Yamcs is a mission control framework used to manage, process, and archive telemetry and command data for space missions. It functions as the central nervous system for satellite or ground station operations, handling complex data flows and ensuring that mission-critical information is correctly routed and stored for engineering and science teams.

What does CVE-2026-55511 mean for Yamcs?

This vulnerability is classified as CWE-94: Improper Control of Generation of Code. It occurs because the software fails to properly sanitize input when processing certain SQL queries. This mistake allows an attacker to inject and force the system to compile and run unauthorized Java code directly within the Yamcs server process.

How can an attacker trigger this code execution flaw?

An attacker must have specific authenticated system privileges, specifically SystemPrivilege.ControlArchiving, to interact with the vulnerable SQL endpoint. Simply sending arbitrary network traffic or accessing the web interface without these high-level credentials will not trigger the bug; the attacker must be able to craft and submit a specifically formatted SQL query containing malicious column names.

Should I be concerned if my Yamcs instance is internal?

Yes. According to Halo Surface Signal, while Yamcs is typically deployed in restricted, internal environments, the risk remains significant if an unauthorized user or a compromised account gains access to your network. Because the vulnerability allows for complete control over the server process, even internal systems should be prioritized for patching.

How do I fix this Yamcs vulnerability?

Your first step is to inventory all running instances of Yamcs to identify those on versions prior to 5.12.8 or 5.13.2. Once identified, coordinate with your infrastructure or platform team to schedule an update to these patched versions, which contain the necessary input sanitization fixes to prevent unauthorized code compilation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.