CVE-2026-26741

PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" state (after landing and before the automatic disarm triggered by the COM_DISARM_LAND parameter), the system lacks a throttle threshold safety check for the physical throttle stick. This flaw can directly cause the drone to lose control, experience rapid uncontrolled ascent (flyaway), and result in property damage

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md	Exploit Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 19:17

Updated : 2026-03-12 17:05

NVD link : CVE-2026-26741

Mitre link : CVE-2026-26741

CVE.ORG link : CVE-2026-26741

JSON object : View

Products Affected

dronecode

px4_drone_autopilot

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-26741", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2026-03-10T19:17:17.103", "references": [{"url": "https://github.com/npuwyw/PX4-Autopilot/blob/audit-v1.12.3-mode-transition-logic-flaw/PX4_Autopilot_Mode_Switching_Logic_Vulnerability.md", "tags": ["Exploit", "Vendor Advisory", "Mitigation"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the \"ARMED\" state (after landing and before the automatic disarm triggered by the COM_DISARM_LAND parameter), the system lacks a throttle threshold safety check for the physical throttle stick. This flaw can directly cause the drone to lose control, experience rapid uncontrolled ascent (flyaway), and result in property damage"}, {"lang": "es", "value": "Las versiones del piloto autom\u00e1tico PX4 de la 1.12.x a la 1.15.x contienen un fallo l\u00f3gico en el mecanismo de cambio de modo. Al cambiar del modo autom\u00e1tico al modo manual mientras el dron est\u00e1 en estado 'ARMADO' (despu\u00e9s del aterrizaje y antes del desarmado autom\u00e1tico activado por el par\u00e1metro COM_DISARM_LAND), el sistema carece de una comprobaci\u00f3n de seguridad del umbral del acelerador para la palanca f\u00edsica del acelerador. Este fallo puede causar directamente que el dron pierda el control, experimente un ascenso r\u00e1pido e incontrolado (flyaway) y provoque da\u00f1os a la propiedad."}], "lastModified": "2026-03-12T17:05:29.457", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dronecode:px4_drone_autopilot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A8C03F6-C15B-44A0-8FF2-05E73A47F26E", "versionEndExcluding": "1.16.0", "versionStartIncluding": "1.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}