CVE-2026-2675: RTI Connext Professional Data Source Spoofing Vulnerability

Technical summary

CVE-2026-2675 is a missing authentication vulnerability (CWE-306) affecting RTI Connext Professional's security plugins. The flaw permits an authenticated attacker to forge the source identity of data within the middleware, bypassing controls that normally ensure data authenticity. The vulnerability exists in multiple version branches: 7.4.0–7.6.x, 7.0.0–7.3.1.2, 6.1.0–6.1.x, 6.0.0–6.0.x, and 5.3.0–5.3.x. With network accessibility and valid credentials, an attacker can craft malicious data packets that the system accepts as originating from trusted producers, enabling man-in-the-middle style attacks within the DDS (Data Distribution Service) infrastructure.

Business impact

Organizations relying on Connext Professional for mission-critical distributed systems face data integrity risks. Financial systems, industrial control networks, autonomous systems, and real-time collaborative platforms could receive spoofed data without detection. Depending on downstream validation practices, this could lead to incorrect decisions, operational failures, or security breaches. Remediation delays increase exposure window for sophisticated adversaries targeting data authenticity as a vector.

Affected systems

RTI Connext Professional versions are affected across four major release lines. Versions 7.4.0 through 7.6.x, 7.0.0 through 7.3.1.2, 6.1.0 through 6.1.x, 6.0.0 through 6.0.x, and 5.3.0 through 5.3.x all contain the flaw. Organizations using Connext Professional in production should inventory deployed versions immediately. The vulnerability does not affect non-professional editions or deployments that do not utilize the security plugins.

Exploitability

The attack requires network access to the Connext middleware and valid authentication credentials. The CVSS score of 6.5 reflects low attack complexity but mandatory low-privilege user status. While not trivially exploitable by unauthenticated threat actors, the barrier is moderate: once insider access or credential compromise occurs, exploitation is straightforward and requires no special tools. No public exploit code is known at publication; however, the simplicity of the underlying flaw (missing authentication check) suggests rapid weaponization is possible if details proliferate.

Remediation

RTI has released patched versions for affected release streams. Organizations must upgrade to patched versions in each branch: verify against RTI's security advisory for the specific patch versions available for 7.7.0+, 7.3.1.3+, and corresponding patches for 6.x and 5.x lines. Patch testing should prioritize systems with the highest data integrity requirements. Where immediate patching is not feasible, implement network segmentation to restrict Connext access to authenticated, trusted entities only, and enhance monitoring of data source changes.

Patch guidance

Consult the RTI Connext Professional security bulletin for precise patch version numbers by release branch. Organizations should establish a staged rollout plan, testing patches in non-production environments first, particularly for systems with stringent real-time requirements. Given the MEDIUM severity and the requirement for authentication, patching can be scheduled within standard change windows, but should not be deferred beyond 60 days. Verify patch integrity and confirm successful deployment via version checks post-update.

Detection guidance

Monitor Connext middleware logs for anomalous source identity changes or data producer claims from unexpected endpoints. Implement network-level monitoring for DDS traffic patterns and source-destination relationships. Organizations with application-level validation of data provenance should review those controls and ensure they are not reliant on unverified source claims from the middleware. Consider enhanced logging of authentication events and data source transitions within Connext security plugins during the patching window to identify any exploitation attempts.

Why prioritize this

Although CVSS 6.5 classifies this as MEDIUM severity, the nature of the vulnerability—data source spoofing—poses significant business risk in sectors where data integrity is non-negotiable (finance, industrial, autonomous systems). The requirement for authentication reduces immediate risk from external threat actors but increases insider threat surface. Prioritize based on data criticality: systems handling real-time control, financial transactions, or safety-related data warrant faster patching. Not currently on the CISA KEV list, suggesting limited active exploitation, but this does not diminish the strategic importance of patching before adversaries discover and weaponize the flaw.

Risk score, explained

The CVSS 6.5 score reflects a network-accessible vulnerability with low attack complexity that requires low privileges. The impact vector shows no confidentiality or availability loss but high integrity impact—precise for a data spoofing flaw. The score appropriately captures the threat but should be contextualized with organizational risk: systems with strong downstream data validation will have lower practical risk than those relying on implicit trust in source identity. Consider raising priority for data-critical applications even if the base CVSS is moderate.

Frequently asked questions