SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-86097

MEDIUM · CVSS 6.5 EPSS 0.24% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The PX4 Autopilot software is vulnerable to a null pointer dereference in the param_set_default_file() and param_set_backup_file() functions, which can be exploited by attackers to crash the autopilot process. This issue can be triggered by executing 'param select' or 'param select-backup' commands without a path argument from any PX4 shell. Developers and operators of PX4 Autopilot systems should prioritize addressing this vulnerability to maintain system stability and prevent potential disruptions.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-86097
Severity
MEDIUM
CVSS
6.5
EPSS
0.24%

Original NVD Description

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any PX4 shell to trigger the crash.