Which versions of NASA cFS are affected by CVE-2026-18064?

NASA's core Flight System (cFS) Health and Safety application through version 7.0.1 contains a denial-of-service vulnerability that can trigger processor resets, disrupting mission-critical…

How to fix or mitigate CVE-2026-18064?

Within 24 hours: inventory all systems running NASA cFS HS versions through 7.0.1 and categorize by mission criticality; immediately restrict HS command delivery through access controls and operator authentication. Within 7 days: implement comprehensive monitoring and alerting for exploitation attempts; document all compensating controls and alternative command paths; coordinate with NASA JPL for patch timelines. Within 30 days: evaluate architectural mitigations such as enhanced input validation, network segmentation of flight software, or system redundancy; establish procedures for rapid detection and recovery from processor resets; plan testing of compensating controls under mission scenarios.

NASA cFS CVE-2026-18064

Q: What is the CVSS score of CVE-2026-18064?

CVE-2026-18064 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51331 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-30 icscert

GHSA-cwcv-w3jg-jv76

Null Pointer Dereference Denial Of Service Core Flight System Cfs Health Safety Hs Application

8.2

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-deliverable command with no auth or interaction (AV:N/PR:N/UI:N), but 'specific conditions' required maps to AC:H; impact is a crash/reset so A:H with C:N/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 30, 2026 - 22:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 22:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 22:37 NVD

7.5 (HIGH) 8.2 (HIGH)

Analysis Generated

Jul 30, 2026 - 22:15 vuln.today

CVE Published

Jul 30, 2026 - 21:35 cve.org

HIGH 7.5

DescriptionCVE.org

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.

AnalysisAI

Denial-of-service in the NASA core Flight System (cFS) Health and Safety (HS) application affects versions through 7.0.1, where a NULL pointer dereference left reachable by an incomplete fix for CVE-2026-15352 lets an attacker who can deliver a specific HS command under particular conditions crash the HS application and force a processor reset. The flaw impacts availability only - no confidentiality or integrity loss - and there is no public exploit identified at time of analysis, though it was reported through CISA ICS-CERT (advisory ICSA-26-211-06). Because cFS runs as the flight software framework aboard spacecraft and embedded aerospace systems, a triggered reset can disrupt mission-critical monitoring rather than expose data.

Technical ContextAI

core Flight System (cFS) is NASA's open-source, reusable flight-software framework built around a message-passing Software Bus and modular applications; the Health and Safety (HS) application monitors application liveness (via check-in/heartbeat and event message counting), manages watchdog servicing, and can command processor or application resets when faults are detected. The root cause is CWE-476 (NULL Pointer Dereference): a code path reachable when a particular HS command is processed dereferences a pointer that can be NULL, and the earlier remediation for CVE-2026-15352 did not close every reachable path, leaving a distinct dereference exploitable. Because HS itself is the fault-management component that services the watchdog and drives resets, crashing it directly undermines the subsystem responsible for keeping the flight processor healthy, and the crash cascades into a processor reset. The affected component is identified by CPE cpe:2.3:a:nasa:core_flight_system_(cfs)_health_&_safety_(hs)_application, i.e. the nasa/HS repository, in versions up to and including 7.0.1.

RemediationAI

No vendor-released fixed version is stated in the available data, so patch status here is: upstream fix location known (nasa/HS) but a released patched version is not independently confirmed at time of analysis - monitor the nasa/HS repository (https://github.com/nasa/HS) and the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06) for a tagged release beyond 7.0.1 that fully closes the dereference, and note that because this is an incomplete fix for CVE-2026-15352 you should not assume the CVE-2026-15352 patch is sufficient. Until a complete fix is confirmed, apply compensating controls: restrict who and what can send commands to the HS application by tightening Software Bus command routing and command authorization/whitelisting so the specific triggering command cannot be delivered from untrusted sources (trade-off: may block legitimate operational commands and requires careful command-table review); enforce command authentication and integrity on the ground-to-spacecraft command link so unauthorized command injection is not possible (trade-off: operational and key-management overhead); and, if the affected command is not operationally required, disable or filter it at the command dispatch layer (trade-off: loss of that HS management capability). Because HS drives watchdog servicing and resets, validate any mitigation against fault-management behavior so you do not inadvertently weaken legitimate reset handling.