Major PX4 drone software vulnerability raises hijacking concerns

A widely used piece of drone software just got a serious cybersecurity wake-up call, and if you operate drones in the US, it’s something you’ll want to pay attention to.

CYVIATION, an aviation cybersecurity firm, has uncovered a critical vulnerability in PX4 Autopilot — one of the most popular open-source flight control platforms powering drones around the world. The issue is severe enough that the US Cybersecurity and Infrastructure Security Agency (CISA) has issued an official advisory, flagging it as a high-risk threat.

At the heart of the issue is something surprisingly simple: a missing layer of authentication.

According to CYVIATION, drones running PX4 Autopilot may, by default, lack proper verification on their communication channels. In plain English, that means there’s no built-in “digital signature” confirming that commands sent to the drone are legitimate.

That opens the door for a worst-case scenario — an attacker connected to the same network could inject malicious commands and effectively hijack the drone mid-flight. We’re talking full control over navigation, behavior, and potentially even onboard systems.

The vulnerability, tracked as CVE-2026-1579, has been assigned a near-max severity score of 9.8 out of 10. That’s about as serious as it gets in cybersecurity terms.

Now, PX4 isn’t some niche software. It’s part of a broader open-source ecosystem supported by Dronecode under the Linux Foundation. It’s widely used by developers, startups, researchers, and even enterprise drone operators. That includes drones deployed in:

• Emergency response
• Defense and security operations
• Commercial inspections and logistics

So while there’s no confirmed real-world exploitation yet, the potential impact is huge. A compromised drone in any of these environments could lead to operational disruptions, or worse, safety risks.

What operators should do right now

The good news? This isn’t a hardware flaw. It’s fixable with better configuration and security practices. Both CYVIATION and CISA are urging operators to take immediate action:

1. Turn on digital signatures
Enable MAVLink 2.0 message signing. This ensures your drone only accepts commands from trusted sources.

2. Lock down your network
Keep drones and their control systems off public internet connections. Use firewalls and isolate them from broader business networks.

3. Follow official hardening guides
PX4 offers a security hardening guide with step-by-step instructions. Now’s the time to use it.

CISA also recommends minimizing network exposure across all control systems and using secure remote access methods like VPNs, while keeping those VPNs fully updated.

This discovery highlights a broader trend: as drones become more capable, they’re also becoming more attractive targets for cyberattacks. CYVIATION says this is just the beginning. The company is actively investigating other flight control systems and drone networks, suggesting more findings could be on the way.

For years, the drone industry has focused heavily on performance — better cameras, longer flight times, smarter AI. But this incident is a reminder that cybersecurity needs to keep pace. If you’re running PX4-powered drones, this isn’t something to put off. A simple configuration change could be the difference between a secure flight and a compromised one.

More: DJI confirms end-of-support timeline for Mavic 2, Matrice 600 drones