PX4 Autopilot Vulnerability - Attackers Can Control Drones

What Happened

A critical vulnerability has been discovered in the widely used PX4 Autopilot software, which is essential for controlling drones and autonomous vehicles. The Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on March 31, 2026, alerting operators to this severe flaw. The vulnerability, tracked as CVE-2026-1579, poses a significant threat to critical infrastructure, particularly in sectors like Transportation Systems, Emergency Services, and the Defense Industrial Base.

The Flaw

The vulnerability has a near-maximum CVSS v3 score of 9.8, categorizing it as critical. The core issue arises from the lack of an authentication mechanism for a crucial function within the software. If an attacker gains access to the drone’s MAVLink interface, the primary communication protocol for commands and telemetry, they can exploit this flaw to bypass security checks. This allows them to execute arbitrary commands on the drone’s operating system without any cryptographic authentication.

What's at Risk

Once an attacker connects to the drone, they can:

• Alter flight paths
• Force crashes
• Intercept sensitive data
• Lock legitimate operators out of the system This level of control poses a serious risk not only to individual drone operators but also to public safety and national security given the critical infrastructure involved.

Patch Status

Currently, there is no known public exploitation of this vulnerability. However, the specific version affected is PX4 Autopilot v1.16.0_SITL_latest_stable. Security researcher Dolev Aviv from Cyviation discovered and reported this flaw to CISA.

Immediate Actions

To mitigate risks associated with this vulnerability, CISA recommends several defensive measures:

• Minimize network exposure for all control system devices, ensuring they are not directly accessible from the internet.
• Place control system networks and remote devices behind strict firewalls, isolating them from corporate networks.
• Use secure, fully updated Virtual Private Networks (VPNs) for remote access when necessary.
• Conduct a thorough risk assessment before implementing new defensive measures to avoid operational disruptions.
• Train staff to resist social engineering attacks, as attackers often use phishing to gain initial access.
• Continuously monitor CISA alerts and apply vendor patches as they become available.

By following these recommendations, organizations can better protect their drone fleets and critical infrastructure from potential exploitation.