External risk intelligence

Yamcs LikeExpression Java Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-55565

The vulnerability exists within web API endpoints (POST /api/...) of the Yamcs mission control framework. These APIs are designed for programmatic interaction and data management, making them common targets for network-based exposure in environments where the service is used for remote operations, monitoring, or data integration.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a vulnerability in the Yamcs mission control framework that could allow an attacker to inject malicious code and execute it on the server. The issue stems from improper handling of patterns in certain API requests, potentially leading to unauthorized actions or data compromise if the affected system is exploited.

Code injection flaw in mission control software.
Critical flaw could allow server compromise.
Assess impact and confirm relevance.

Attack Path

How an attacker could exploit the issue

An attacker can target the Yamcs mission control framework by sending specially crafted input through various API endpoints. If the attacker has basic access, they can submit data that includes an unescaped LIKE pattern. This pattern is then inserted into Java code that is compiled, allowing the attacker to inject and execute arbitrary Java code on the Yamcs server.

Requires authenticated access.
Triggers via API calls with LIKE patterns.
Allows arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in Yamcs could allow an attacker to inject malicious Java code by manipulating LIKE patterns in SQL queries sent via specific API endpoints. This could lead to the execution of arbitrary code on the Yamcs server process, impacting system operations and potentially sensitive information.

Server process code execution.
Unescaped LIKE pattern in SQL queries.
Compromise of server and data integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Yamcs mission control framework is affected by a critical vulnerability that allows for code injection through unescaped LIKE patterns in SQL queries. Technical leaders and system owners should initiate an asset inventory to identify all instances of Yamcs, followed by an exposure assessment to determine reachability and business criticality. Once identified, the accountable owner must be confirmed to plan remediation, likely involving vendor coordination or an upgrade to a patched version.

Yamcs application owners should drive remediation.
Verify all Yamcs instances and their exposure.
Plan and execute necessary upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Yamcs mission control framework?

Yamcs is an open-source software platform used for space mission control. It provides the core infrastructure to manage, monitor, and process telemetry and commanding data from satellites or ground-based equipment, acting as a central hub for mission operations and data archiving.

How does this CVE-2026-55565 vulnerability work?

This is a Code Injection vulnerability, specifically identified as CWE-94. The software fails to properly sanitize special characters in database search patterns. Because the application processes these patterns by compiling them into Java code on the fly, an attacker can escape the intended search function to inject and run their own unauthorized Java commands.

What triggers this injection vulnerability?

The flaw is triggered when a user sends a specially crafted request containing a malicious LIKE pattern to specific API endpoints, such as SQL query or event search interfaces. Importantly, standard read operations that do not involve providing custom filter patterns, or requests that do not use the vulnerable API paths, do not trigger this code execution.

Is my instance of Yamcs at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your Yamcs installation exposes its API endpoints to the network, which is common in environments set up for remote monitoring or automated data integration. You should prioritize assets where these service endpoints are reachable over a network rather than isolated on a local, internal-only segment.

How should I respond to this vulnerability?

First, identify all active Yamcs deployments in your environment and determine which ones are running versions prior to 5.12.8 or 5.13.2. Once mapped, coordinate with your engineering or operations teams to schedule an upgrade to the patched versions, which correctly handle input strings to prevent unauthorized code compilation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.