RTI Connext Updates Address Nineteen Vulnerabilities
Tech GuruQuick Answer
RTI-SB-2026-09 covers nineteen vulnerabilities across Connext Professional and the AUTOSAR Toolkit. RTI provides Professional 7.3.1.6 for the 7.3.1 branch, 7.7.0.1 for 7.7.0, and Toolkit 4.0.1.1 for 4.0.1. Applicability depends on the component, architecture and configuration; other branches or architectures require RTI Support guidance.
Confirm Scope And Apply The Supported Fix
What to do now: Map deployed libraries and services to their RTI branch, architecture, API and security configuration. Obtain the matching patch from the Customer Portal and plan application rebuild/redeployment and interoperability checks as appropriate.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RTI Connext Professional and Connext AUTOSAR Toolkit |
|---|---|
| Advisory | RTI-SB-2026-09 |
| CVEs | CVE-2025-70873, CVE-2026-11388, CVE-2026-11389, CVE-2026-18457, CVE-2026-18458, CVE-2026-18459, CVE-2026-18460, CVE-2026-18461, CVE-2026-18462, CVE-2026-18626, CVE-2026-34180, CVE-2026-34480, CVE-2026-41080, CVE-2026-45186, CVE-2026-45447, CVE-2026-56132, CVE-2026-56407, CVE-2026-7866, CVE-2026-8849 |
| RTI bulletin publication | 2026-09-22 (RTI bulletin) |
| Recorded source timestamp (historical snapshot) | 2026-09-22 17:50:13.857 UTC |
| Affected versions | Connext Professional 4.1x through versions before 7.7.0.1 and Connext AUTOSAR Toolkit 2.0.0 through versions before 4.0.1.1, subject to the per-CVE table |
| Fixed version | Connext Professional 7.3.1.6 or 7.7.0.1 and AUTOSAR Toolkit 4.0.1.1; contact RTI Support for other supported versions and architectures |
| CVSS base score | 3.3 / 4.7 / 5.3 / 5.5 / 6.5 / 7.0 / 7.1 / 7.4 / 7.5 / 7.8 / 8.1 / 8.8 / 9.8 (CVSS v3.1) |
| CVSS severity | Low to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The bulletin combines distinct input paths. Several flaws require malicious local XML or QoS configuration; the Expat overflows CVE-2026-56132 and CVE-2026-56407 exclude 32-bit Professional builds. CVE-2026-41080 is normally local, with a network path only when an Infrastructure Service enables Remote Administration and disables XML schema validation.
Other issues concern DDS samples, locators or specific tools. CVE-2026-18457 requires C or Traditional C++, unbounded strings, reuse of a sample with copy-based read/take, and an allocation failure. CVE-2026-8849 requires a race while parsing Permissions Documents; the network path also requires credentials that pass authentication. These examples explain why the nineteen-CVE list is not a uniform exposure statement. Consult the linked per-CVE descriptions for every deployed component.
What To Validate Now
- Inventory. Include Core Libraries, Java/C/Traditional C++ clients, DDS Spy, Recording Service, Distributed Logger, Security Plugins and AUTOSAR generators where installed. Record QoS/XML sources and Remote Administration exposure.
- Establish applicability. Use RTI's individual CVE tables, not the broad earliest-to-latest range alone. For example, the cited Expat overflow paths in Professional are 64-bit-specific, and the Permissions Document race affects Professional 7.6.0 before 7.7.0.1.
- Remediate. Apply Professional 7.3.1.6 to 7.3.1 or 7.7.0.1 to 7.7.0, and Toolkit 4.0.1.1 to 4.0.1. Request patches for other versions/architectures from RTI; wildcard entries in affected-version tables are not downloadable fixed builds.
- Validate. Confirm the libraries actually loaded by each application, then check discovery, sample exchange, permissions, recording and logging for the deployed components. Preserve application recovery and cross-version interoperability results; no live Connext tests were performed for this review.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
RTPS protection can block specified unauthorized network paths, but it does not replace local XML/QoS file permissions or every plugin fix. RTI lists no mitigation for the OpenSSL Permissions Document and OCSP issues. Apply each CVE's own conditions rather than treating Security Plugins as a universal exemption.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
