CVE-2026-2675 Details
Description
Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Fake the Source of Data. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.
A vulnerability exists in RTI Connext Professional (Security Plugins) versions 7.4.0 prior to 7.7.0, 7.0.0 prior to 7.3.1.3, 6.1.0 prior to 6.1.*, 6.0.0 prior to 6.0.*, and 5.3.0 prior to 5.3.*. This vulnerability allows a malicious authenticated participant to impersonate another participant by bypassing the RTPS origin authentication. The attacker can send messages that appear to come from the impersonated participant, potentially disrupting communication and data integrity.
Users can upgrade to RTI Connext Professional versions 7.3.1.3 or 7.7.0, or contact RTI Support to arrange for a patch on other versions and architectures.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.rti.com/vulnerabilities/#cve-2026-2675 | RTI | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | RTI |
Affected Products
| Product | Versions |
|---|---|
| rti connext professional | >= 5.3.0, < 7.7.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | CVE Modified | RTI |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | RTI |