What is the CVSS score of CVE-2026-67978?

CVE-2026-67978 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of NASA cFS are affected by CVE-2026-67978?

NASA core Flight System v7.0.1 contains a denial-of-service vulnerability in the SBN UDP interface that can be triggered by any network-adjacent unauthenticated attacker using a single crafted frame.

How to fix or mitigate CVE-2026-67978?

Within 24 hours, identify all systems running cFS v7.0.1 and restrict network access to the SBN UDP interface through firewall rules, limiting connectivity to only trusted networks and systems. Within 7 days, implement network segmentation to isolate affected systems and deploy intrusion detection systems configured to monitor for malformed SBN frames. Within 30 days, contact NASA regarding patch availability and timeline, and develop a test plan for upgrading to a patched cFS version once available.

NASA cFS CVE-2026-67978

EUVD-2026-52505 HIGH

Improper Input Validation (CWE-20)

2026-08-03 mitre

GHSA-8qgf-5ch2-wq2q

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

UDP service is network-exposed with no authentication required; impact is availability-only as the SBN crash denies inter-CPU messaging without data disclosure or modification.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:23 vuln.today

CVSS changed

Aug 04, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Aug 03, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 03, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame.

AnalysisAI

Denial of Service in NASA core Flight System (cFS) v7.0.1 is achievable by any network-adjacent attacker who can reach the SBN UDP interface, requiring no authentication or special privileges. Sending a single crafted SBN frame is sufficient to trigger the fault, consistent with CWE-20 (Improper Input Validation) in the Software Bus Network application's UDP packet handler. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.14% (4th percentile), reflecting the niche aerospace deployment footprint rather than low technical severity.

Technical ContextAI

NASA cFS (core Flight System) is an open-source, reusable flight software operating system framework designed for spacecraft and aerospace embedded systems. The SBN (Software Bus Network) application is a cFS component that bridges software bus messages between physically separate flight computers over UDP, enabling inter-CPU publish-subscribe communication in multi-processor mission architectures. CWE-20 (Improper Input Validation) identifies the root cause: the SBN UDP frame parser in cFS v7.0.1 does not sufficiently validate the structure or content of incoming SBN frames before processing them, allowing a malformed frame to cause an application fault. CPE data in the NVD entry is listed as n/a, so affected product scope is constrained to the description-stated version (v7.0.1) and the GitHub issue tracker at nasa/cFS.

RemediationAI

No vendor-released patch version has been independently confirmed at time of analysis; the upstream tracking issue at https://github.com/nasa/cFS/issues/1058 should be monitored for fix releases. As compensating controls: restrict network access to the SBN UDP port to only trusted, enumerated flight computer IP addresses using host-based or perimeter firewall rules - this is the highest-value mitigation since it eliminates the network-reachable attack surface without altering mission software. If inter-CPU SBN communication is not operationally required, disable the SBN application entirely in the cFS startup script. Implement ingress rate limiting and SBN frame size enforcement at the network boundary to reduce the blast radius of malformed packets. Note that firewall rule changes in flight or ground support environments require configuration change board approval and regression testing.