CVE-2026-42084: OpenC3 COSMOS Allows Password Change Without Old Password

The National Vulnerability Database has detailed CVE-2026-42084, a high-severity vulnerability (CVSS 8.1) in OpenC3 COSMOS versions prior to 6.10.5 and 7.0.0-rc3. This flaw allows users to change their password using only a valid session token, bypassing the requirement for the old password. This isn’t a speculative risk; it’s a critical persistence vector.

In an assumed breach scenario, this vulnerability significantly amplifies an attacker’s post-compromise capabilities. If an adversary has already obtained a valid session token — perhaps through a phishing attack, a separate credential stuffing incident, or internal network access — they can leverage this flaw to hijack accounts, including administrative ones. This effectively locks out legitimate users and establishes a durable foothold for the attacker, making incident response far more complex.

Defenders must prioritize patching. OpenC3 COSMOS versions 6.10.5 and 7.0.0-rc3 address this issue. For organizations that rely on OpenC3 COSMOS, the immediate focus should be on upgrading to these patched versions. Furthermore, security teams should scrutinize session management and look for anomalous password change events, particularly for high-privilege accounts, as these could indicate active exploitation in already compromised environments.