Critical PX4 Autopilot Vulnerability Let Attackers Gain Control of Drones

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a high-priority alert regarding a severe vulnerability in the PX4 Autopilot system.

This critical flaw could allow malicious actors to completely take over unmanned aerial vehicles (UAVs) and drones used across vital infrastructure sectors.

Tracked as CVE-2026-1579, the security flaw carries a near-maximum Common Vulnerability Scoring System (CVSS) v3 score of 9.8 out of 10.

The vulnerability stems from a “Missing Authentication for Critical Function” error within the drone’s flight software.

How the Attack Works

PX4 Autopilot is a popular open-source flight control software used worldwide to manage drones and other autonomous vehicles.

The newly discovered vulnerability exists in how the software handles communication through the MAVLink interface.

MAVLink is a messaging protocol used to send commands and telemetry data between drones and ground control stations.

According to the CISA advisory (ICSA-26-090-02) released on March 31, 2026, an attacker who gains access to the MAVLink interface can exploit this weakness to bypass security checks.

Because the system fails to require cryptographic authentication for critical commands, the attacker can execute arbitrary shell commands.

A hacker could intercept the drone’s communication pathway and issue unauthorised instructions, effectively hijacking the flight controller without needing a password or security key.

The potential real-world consequences of this flaw are significant. The Switzerland-based PX4 Autopilot system is deployed globally across highly sensitive critical infrastructure sectors. The affected industries include:

• Transportation Systems
• Emergency Services
• Defense Industrial Base

A successful remote takeover of drones operating in these environments could lead to stolen surveillance data, disrupted emergency response efforts, or compromised defense operations.

The vulnerability specifically impacts the PX4 Autopilot version v1.16.0_SITL_latest_stable.

Organizations and operators utilizing this open-source flight control software are strongly urged to review their network architecture.

Until a patch is deployed, administrators should restrict MAVLink interface access to trusted networks and users only.

The critical flaw was discovered and reported to CISA by security researcher Dolev Aviv from the cybersecurity firm Cyviation.

Drone operators and organizations relying on the PX4 ecosystem should closely monitor official channels for updates and immediately implement defensive measures to secure their drone communication links against unauthorized access.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.