CVE-2026-77602: Critical OpenC3 COSMOS Code Execution

CVE explainers 2026-09-23 8 min read

Security Research Desk Expert reviewed

Threat intelligence · Human-verified · Updated 2026-09-23

▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.

CISOBrief · 30-second brief

TL;DR - CVE-2026-77602 allows authenticated non-administrator users to introduce content that is later processed as code. - OpenC3 COSMOS 5.1.0 through versions before 7.3.0 are affected. Upgrade to 7.3.0 or later. - No verified public proof of concept or confirmed in-the-wild exploitation was identified, but the CVSS score is Critical.

Field	Value
CVE	CVE-2026-77602
CVSS v3 base score	9.9 Critical
CVSS vector	Not included in the retrieved NVD result; confirm the vector in the NVD record
Attack vector	Not confirmed from the available CVSS vector data
Authentication / privileges	Authenticated non-administrator account required
Patch available	Yes, fixed in OpenC3 COSMOS 7.3.0
CISA KEV status	Not listed as of 2026-09-23

What Is the Root Cause?

The underlying issue is insufficient separation between user-controlled content written to targets_modified/ and processing paths that treat files in that overlay as trusted configuration or executable content. The application allows a non-administrator to place content through normal features, while later processing can interpret that content through higher-privilege execution mechanisms.

The affected code paths include ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, and GENERIC_WRITE_CONVERSION. These paths can invoke ERB rendering or Ruby and Python evaluation. In addition, openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through Ruby require.

Analyst’s Take: The patch should come before extensive detection work because an authenticated non-administrator can reach the vulnerable write paths, and the fixed version is available. Detection still matters after or during the upgrade, particularly where COSMOS services can access credentials or sensitive operational data.

This creates a privilege-boundary failure: the account that writes the content does not need administrator privileges, while the service that processes it may have broader access.

The practical impact is server-side code execution rather than merely unauthorized configuration modification. A successful attacker could potentially access credentials, internal data, service-to-service connections, or other resources available to the affected COSMOS processes. The exact impact depends on deployment architecture, service permissions, secrets exposure, and network controls.

AnalystImpact · assess the risk

What Happened, in Brief

CVE-2026-77602 is a code-execution vulnerability in OpenC3 COSMOS, a platform used to send commands to and receive data from embedded systems. A user with a valid, non-administrator account can write content into the targets_modified/ overlay through application features such as storage uploads, screen saves, and script creation.

Configuration and scripting paths later process that content. Depending on the path, they can render ERB, evaluate Ruby or Python, or load suite procedure files. Execution can then occur in the command-and-telemetry API, decom microservices, or Script Runner. Those services may have access to internal credentials and sensitive operational data.

The affected range is OpenC3 COSMOS 5.1.0 through versions before 7.3.0. The vendor fix is identified as version 7.3.0. Administrators should treat every deployment in the affected range as vulnerable unless the relevant components have been independently remediated.

Who Needs to Act?

Organizations running OpenC3 COSMOS 5.1.0 through any release before 7.3.0 need to take action. This includes deployments where only trusted personnel are expected to use the system, because the vulnerable capability is available to authenticated non-administrator users. An attacker who first obtains a legitimate account through password reuse, phishing, session theft, or another unrelated weakness may be able to use this flaw.

Product	Affected versions	Fixed version	Required action
OpenC3 COSMOS	5.1.0 through before 7.3.0, including 7.2.x	7.3.0	Upgrade to 7.3.0 or later

Prioritize internet-accessible COSMOS interfaces, deployments with multiple users, environments where non-administrators can upload files or create scripts, and systems whose COSMOS services hold credentials for internal systems. If your organization cannot verify the precise release currently deployed, identify the running image, package, or application version before considering the system remediated.

Organizations that use jump hosts or other privileged access systems should also review the access path to COSMOS interfaces. See our jump server FAQ for related access-control considerations.

Why Is the CVSS Score Critical?

The published CVSS v3 base score is 9.9, Critical. The retrieved NVD result did not include the complete CVSS vector string, so confirm the individual metric values, including the exact attack vector and scope components, directly in the NVD record before quoting them in an asset register or risk report.

The high score is consistent with a vulnerability that permits code execution through a relatively low-privilege authenticated account and can affect internal services with access to credentials and data. It should not be interpreted as proof that exploitation is unauthenticated or internet-wide. The available description explicitly identifies an authenticated non-administrator as the initiating user, while deployment configuration determines whether the vulnerable interfaces are reachable and whether useful secrets are exposed.

Until the vector is confirmed, avoid inventing component values such as Network attack vector, Low privileges required, or Changed scope. Use the known facts in risk decisions: the score is 9.9, authentication is required, non-administrator access is sufficient, and the fixed version is 7.3.0.

Has CVE-2026-77602 Been Exploited?

CVE-2026-77602 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. CISA KEV therefore provides no confirmation that the vulnerability is being exploited in the wild. The reviewed material also did not identify authoritative evidence of active exploitation in customer environments or a ransomware campaign associated with this CVE.

No verified public exploit repository or working public proof of concept was identified in the sources reviewed. That status can change, particularly because the vulnerable behavior involves recognizable file-placement and reload workflows. The absence of a proof of concept or KEV entry does not show that exploitation is impossible.

The GitHub advisory, remediation commits, and pull request provide public technical context and remediation references. Monitor them for further discussion, regression reports, or proof-of-concept material. Organizations should continue investigating suspicious activity in affected deployments even if no public exploit is currently available.

How Do I Know If I’m Affected?

First, establish whether the deployment runs a vulnerable version. Check the COSMOS image, package manifest, release metadata, or administrative interface and compare it with the affected range. A system running 5.1.0 through 7.2.x should be considered exposed until upgraded.

Next, review who could write content into the overlay. Focus on non-administrator accounts with access to storage uploads, screen saves, or script creation. Look for unexpected files under targets_modified/, especially files created shortly before configuration-table processing, command or telemetry reloads, or suite-analysis activity.

Technical Notes

The following searches are detection starting points, not vendor-specific signatures. Adapt paths, container names, and log locations to the deployment:

# Review overlay files and recent modifications
find /path/to/targets_modified -type f -printf '%TY-%Tm-%Td %TH:%TM:%TS %u %p\n' \
  2>/dev/null | sort -r | head -200

# Search application logs for activity associated with affected execution paths
grep -RniE \
  'targets_modified|ConfigParser|PacketConfig|GENERIC_(READ|WRITE)_CONVERSION|run_suite_analysis|suite analysis|reload' \
  /var/log/openc3 2>/dev/null

Centralized logging teams should alert on a sequence involving a non-administrator upload, screen save, or script creation followed by a table or command-and-telemetry reload, suite analysis, or Script Runner execution.

Also review process-spawn, outbound-connection, and secret-access telemetry from the command-and-telemetry API, decom services, and Script Runner. There is no confirmed public network signature in the supplied research, so network monitoring should supplement rather than replace host and application review.

For administrator workstations and jump hosts, pair application logging with appropriate endpoint protection, such as endpoint security software, where suitable for the organization’s security requirements.

What Should I Do About It?

Upgrade OpenC3 COSMOS to 7.3.0 or later. The supplied research identifies 7.3.0 as the fixed version; confirm current OpenC3 release guidance before selecting a later release for production. After upgrading, verify that all relevant COSMOS components use the fixed release rather than updating only one service.

For a deployment managed with Docker Compose, first update the image or release reference in the deployment configuration to 7.3.0 or a later approved version, then recreate the services:

Docker Compose Update

# Run from the directory containing the organization's COSMOS Compose configuration
docker compose pull
docker compose up -d
docker compose ps

The command applies only when the Compose configuration has already been changed to reference the fixed release. Do not assume that docker compose pull alone changes the running version.

For Kubernetes or another deployment system, update the organization’s image or release manifest to 7.3.0 or later and verify the resulting running versions.

Until the upgrade is complete:

Remove unnecessary non-administrator accounts.
Restrict access to storage uploads, screen saves, and script creation.
Limit COSMOS interfaces to trusted management networks.
Review service credentials and tokens.
Prevent affected services from reaching unrelated internal systems where operationally possible.
Monitor for unexpected changes under targets_modified/.

These are compensating controls, not a replacement for the upgrade.

After patching, inspect targets_modified/ for unauthorized files, review recent reload and suite-analysis events, and rotate credentials if suspicious content may have executed. Preserve relevant logs and filesystem timestamps before cleanup if incident response or forensic analysis may be required.

Organizations tracking multiple software vulnerabilities may also want to review our guidance for CVE-2026-60134 and compare remediation status across affected assets.

Sources

The primary vulnerability record is the NVD entry for CVE-2026-77602:

The NVD record should be consulted for the authoritative current CVSS vector and any subsequent modifications. As of the reviewed information dated 2026-09-23, CISA KEV does not list this CVE, and no verified public proof of concept or confirmed in-the-wild exploitation was identified.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.