On 27 August 2026 two CVEs were published for the Unitree G1 EDU humanoid robot platform. CVE-2026-76639 describes an unauthenticated remote code execution chain in firmware through version 1.5.2. The NVD entry carries scores from VulnCheck: CVSS 3.1 base score 8.8, High, and CVSS 4.0 score 8.7.
If you build or run robots, the useful question is not whether you own that exact model. It is whether you can answer the same kind of question for your own stack, fast. This post shows how, using what the public data does and does not tell you.
Safeguard does not control robots. It can scan the dependencies and firmware components in a robot's software inventory and show KEV status next to each finding.
What's affected
Public records for robotics software fall into three groups.
ROS 1 tooling. Three CVEs, all published in 2025, cover command line tools in Robot Operating System distributions "Noetic Ninjemys and earlier":
- CVE-2024-39289: the
rosparamtool useseval()on unsanitised parameter values, allowing arbitrary Python execution. CVSS 3.1 score 7.8, High. - CVE-2024-39835: the
roslaunchtool evaluates substitution arguments witheval(), with the same effect. Score 7.8, High. - CVE-2024-39780: the
dynparamtool usesyaml.load()in itssetandgetverbs. The record carries a 7.8 score from the CNA and 9.8 Critical from NVD.
ROS Noetic reached end of life on 31 May 2025 according to the Open Robotics announcement, so these distributions no longer get regular fixes.
ROS 2 and secure DDS. CVE-2023-24010 concerns a "non-compliant implementation of permission document verification used by some DDS vendors," where an attacker with valid certificates can craft malicious DDS participants, including ROS 2 nodes, to compromise a secure DDS databus. Score 8.2, High, from the CNA.
Robot products and firmware. CVE-2020-10271 describes MiR robots using default ROS packages that expose the computational graph on all network interfaces, so a malicious operator on the network could take control of the ROS logic. NVD scores it 9.8, Critical.
How to check if you're exposed
First, note what the CISA Known Exploited Vulnerabilities catalog says. It is the list of vulnerabilities with evidence of exploitation in the wild. I searched the catalog release dated 16 October 2026, which held 1,748 entries, for the CVEs above:
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
jq -r '.vulnerabilities[].cveID' kev.json | grep -c -E 'CVE-2024-39289|CVE-2024-39835|CVE-2024-39780|CVE-2023-24010|CVE-2020-10271|CVE-2026-76639'
The count was 0. That is a fact about evidence, not about risk. Robotics is small in the exploitation record, so a clean KEV result means "no confirmed exploitation reported to CISA," not "safe." Treat KEV as the top of your priority list, and the NVD record as the rest.
Second, build the inventory. List ROS distributions and package versions, the OS image, and firmware versions. For a quick NVD lookup by keyword:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=robot%20operating%20system&resultsPerPage=40" | jq -r '.vulnerabilities[].cve | [.id, .published[0:10]] | @tsv'
Keyword search is noisy and misses products named differently. Matching by component name and version from an SBOM is more reliable.
What to do now
- Know your ROS distribution. If any machine still runs Noetic, plan the move to a supported ROS 2 release. Until then, restrict who can run
rosparam,roslaunchanddynparamand with what input. - Check network exposure. The MiR entry is about a graph reachable from the network. Confirm which interfaces your ROS master and DDS participants listen on.
- If you use secure DDS, update your DDS vendor per its advisory, and re-test permission documents.
- Look at firmware for default keys and open management ports. The August 2026 Unitree record describes an unauthenticated bridge and a static key. Both are design faults you can look for in your own images.
- Track in a register. For every match, record whether the tool is run on untrusted input, so reachability drives priority, not the CVSS number alone.
Why it matters
Robotics software is old and wide. A robot sold in 2019 may still run an end of life framework and a vendor image nobody has rebuilt. The public data is thin, so you cannot wait for KEV to tell you what to fix. You need your own inventory and a habit of checking it against NVD and KEV on a schedule.
Try it yourself
Take one robot's package list and match it against the three groups above. Mark which components you can reach from the network and which tools run on input you do not control.
Click through it at your own pace, or open it full screen.
Quick check
Does a zero count in the KEV catalog mean a ROS CVE is safe to ignore?
No. KEV lists vulnerabilities with evidence of active exploitation reported to CISA. A CVE absent from KEV can still be exploitable, and the NVD record and your own exposure decide priority.
When did ROS Noetic reach end of life?
31 May 2025, according to the Open Robotics announcement.
