Which versions of NASA cFS are affected by CVE-2026-15352?

NASA's Core Flight System Health & Safety (HS) module versions prior to v7.0.1 contain a high-severity vulnerability enabling remote denial of service attacks that crash the health-monitoring…

How to fix or mitigate CVE-2026-15352?

Within 24 hours, identify all systems running cFS HS versions prior to v7.0.1 and assess their operational criticality. Within 7 days, obtain HS v7.0.1, execute compatibility testing in staging environments, and plan deployment windows. Within 30 days, deploy v7.0.1 to all production systems, prioritizing those exposed to untrusted networks or handling mission-critical operations.

NASA cFS CVE-2026-15352

Q: What is the CVSS score of CVE-2026-15352?

CVE-2026-15352 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-45022 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-16 icscert

GHSA-8472-2q4c-5q85

Denial Of Service Null Pointer Dereference Core Flight System Cfs Health Safety Hs Application Nasa

8.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-deliverable HK request with no auth or interaction (AV:N/PR:N/UI:N), but bus-access precondition maps AT:P to AC:H; impact is availability-only DoS (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 16, 2026 - 20:30 vuln.today

Analysis Generated

Jul 16, 2026 - 20:30 vuln.today

CVSS changed

Jul 16, 2026 - 20:22 NVD

7.5 (HIGH) 8.2 (HIGH)

CVE Published

Jul 16, 2026 - 19:48 cve.org

HIGH 8.2

DescriptionCVE.org

A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.

AnalysisAI

Denial of service in NASA's Core Flight System (cFS) Health & Safety (HS) application allows a remote attacker to crash the application through a NULL pointer dereference triggered while processing a routine Housekeeping Telemetry request. All HS versions prior to v7.0.1 are affected; the crash produces a segmentation fault that halts the health-monitoring task. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a CISA ICS advisory (ICSA-26-197-03) and vendor-tagged fix release exist.

Technical ContextAI

cFS is NASA's open-source flight software framework (Apache 2.0 licensed) used to build spacecraft and embedded aerospace command-and-telemetry systems; the Health & Safety (HS) application is a core cFS component responsible for monitoring application execution, watchdog servicing, event/CPU monitoring, and reporting Housekeeping (HK) telemetry. The root cause is CWE-476 (NULL Pointer Dereference): when the HS application handles a Housekeeping Telemetry request message, a pointer that is dereferenced without a prior validity check causes a segmentation fault. The affected component is identified by CPE cpe:2.3:a:nasa:core_flight_system_(cfs)_health_&_safety_(hs)_application, and the defect is corrected in the HS v7.0.1 release (cFS 'Draco' bundle).

RemediationAI

Vendor-released patch: v7.0.1 - upgrade the cFS Health & Safety application to HS v7.0.1 (part of the cFS 'Draco' v7.0.1 bundle) per https://github.com/nasa/HS/releases/tag/v7.0.1 and review the CISA advisory ICSA-26-197-03 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-03. Because the crash is triggered by a Housekeeping Telemetry request on the software bus, operators who cannot immediately flash updated flight software should restrict who can inject command/telemetry messages onto the cFS Software Bus by tightening ground-station and network access controls to the command uplink, and validate/whitelist HK request sources; the trade-off is added operational overhead and potential disruption to legitimate ground tooling that relies on ad-hoc HK requests. Monitor the HS task for unexpected restarts as a detective control until the patched version is deployed.