What is the CVSS score of CVE-2026-67972?

CVE-2026-67972 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of NASA cFS are affected by CVE-2026-67972?

NASA Core Flight System v7.0.1 contains a network-accessible vulnerability that permits unauthenticated attackers to exfiltrate mission data by redirecting file storage paths; publicly available…

How to fix or mitigate CVE-2026-67972?

Within 24 hours, inventory all systems running NASA cFS v7.0.1 and determine if the CF (CFDP) application is enabled in production deployments. If CFDP is not operationally required, immediately disable the CF application. If CFDP is critical to operations, implement immediate network segmentation to restrict unauthorized access to cFS instances-placing systems behind firewalls and limiting ingress to trusted sources only. Within 7 days, deploy network-based anomaly detection to monitor for suspicious CFDP metadata handling and establish baseline traffic patterns. Monitor CCSDS and NASA advisory channels weekly for patch availability. Within 30 days, conduct a full architecture review to evaluate alternative implementations or hardened CFDP configurations, and develop a migration timeline away from v7.0.1 once vendor guidance is available.

NASA cFS CVE-2026-67972

EUVD-2026-52478 HIGH

Information Exposure (CWE-200)

2026-08-03 mitre

GHSA-r93g-497c-7qvg

Information Disclosure N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable CFDP listener requires no authentication; path control yields confidentiality loss only, with no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:38 vuln.today

CVSS changed

Aug 06, 2026 - 22:22 NVD

7.5 (HIGH)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure.

AnalysisAI

Unauthenticated remote attackers can manipulate the CCSDS File Delivery Protocol (CFDP) metadata handler in NASA Core Flight System v7.0.1, specifically the CF_CFDP_RecvMd() function, to control the destination path where received file content is stored on the target system, resulting in high-impact information disclosure. A publicly available proof-of-concept exists per SSVC classification, making this exploitable without authentication or user interaction against any network-reachable cFS instance with the CF application enabled. Despite the availability of exploit code and network-accessible attack vector, the EPSS score of 0.14% (4th percentile) reflects the extremely limited real-world deployment footprint of this aerospace-domain platform.

Technical ContextAI

NASA's Core Flight System (cFS) is an open-source reusable flight software framework used in space missions. The CF application within cFS implements the CCSDS File Delivery Protocol (CFDP), a standard defined by the Consultative Committee for Space Data Systems for reliable file transfer over space communication links. The CF_CFDP_RecvMd() function is responsible for parsing incoming CFDP Metadata PDUs, which carry transfer-initiation parameters including the destination file path. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class, indicating insufficient validation or sanitization of the attacker-supplied destination path field within the metadata PDU. By crafting a malicious metadata PDU with an arbitrary or traversal-capable destination path, an attacker can redirect where the CF module writes received file content, potentially placing data in sensitive or unintended filesystem locations - a mechanism that enables the information disclosure impact confirmed by the C:H rating in the CVSS vector. The CPE data provided is non-specific ('n/a'), so precise version pinning beyond 'cFS v7.0.1' must be derived from the GitHub advisory at nasa/cFS issue #1073.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified at time of analysis - the primary reference is the GitHub issue at https://github.com/nasa/cFS/issues/1073, which should be monitored for upstream fix status. If a fix commit or tagged release becomes available on the nasa/cFS repository, operators should upgrade immediately. As a compensating control, operators should isolate the cFS CF application from untrusted networks by restricting CFDP UDP or TCP port access to known ground station IP ranges using firewall or access control lists - this eliminates the AV:N attack surface since CFDP traffic can be bounded to authorized endpoints. If the CF application is not operationally required, disabling it entirely removes the attack surface without side effects. Path validation and sanitization of the CFDP metadata destination field should be implemented as a code-level workaround in mission-specific forks pending upstream remediation. All compensating controls should be validated against mission operational requirements before deployment, as restricting CFDP communication channels may impact legitimate file transfer operations.