CVE-2026-776029.9CriticalCWE-94

CVE-2026-77602: OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

OpenC3 · cosmos

Affected: OpenC3 cosmos · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.7%probability of exploitation in the next 30 days

54th percentile

050100

Higher than 54% of scored CVEs

9.9CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

OpenC3 · cosmos>= 5.1.0, < 7.3.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Code Injection · Command and Code Injection
Vendor: OpenC3
Published: September 2026
Band: Unlikely (under 1%), September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-77602 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.