What is the CVSS score of CVE-2026-67979?

CVE-2026-67979 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of NASA cFS are affected by CVE-2026-67979?

NASA's core Flight System (cFS) v7.0.1 contains a critical code execution vulnerability that could allow adversaries to compromise mission-critical space and aerospace operations systems.

How to fix or mitigate CVE-2026-67979?

Within 24 hours, identify all systems running cFS v7.0.1, assess their network connectivity and storage access controls, and isolate mission-critical instances from untrusted network segments. Within 7 days, implement mandatory code signing and integrity verification for all dynamically loaded shared objects, restrict write permissions to application loading directories, and establish continuous monitoring for unauthorized module injection. Within 30 days, coordinate with NASA for patched version timelines, document all cFS systems in your inventory for tracking and accelerated patching once available, and evaluate alternative flight software systems if organizational risk tolerance does not accommodate the current vulnerability window.

NASA cFS CVE-2026-67979

EUVD-2026-52972 CRITICAL

Improper Access Control (CWE-284)

2026-08-04 mitre

GHSA-mjr4-gr3c-hqfc

Authentication Bypass RCE N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.8 HIGH

Planting a shared object requires write access to target storage, so AV:L and PR:L rather than AV:N/PR:N; resulting code execution yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 20:29 vuln.today

CVE Published

Aug 04, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 00:00 cve.org

CRITICAL 9.1

DescriptionCVE.org

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage.

AnalysisAI

Arbitrary code execution in NASA's core Flight System (cFS) v7.0.1 is possible through the Executive Services (ES) dynamic application start path, where improper access control lets an attacker plant a malicious shared object on target storage that is then loaded and run as a flight application. SSVC records a proof-of-concept exploit (publicly available exploit code exists) and rates technical impact as total with automatable exploitation, though EPSS is very low at 0.15% (5th percentile). The published NVD vector is CVSS 9.1 (AV:N), but the described mechanism - dropping a shared object onto storage - implies local write access is a genuine prerequisite.

Technical ContextAI

cFS is NASA's open-source flight software framework; its Executive Services (ES) layer manages the lifecycle of Core Flight Executive (cFE) applications, including dynamically loading application binaries (shared objects) from onboard storage and starting them by symbol/entry point. The flaw is a CWE-284 Improper Access Control weakness in the dynamic application-start path: ES does not adequately restrict or validate the provenance of the shared object it loads, so any code present at the expected storage path is loaded into the flight executive's address space and executed with its privileges. Because cFE app loading is a core, intended feature, the root cause is authorization/trust of the load source rather than a memory-safety bug.

RemediationAI

No vendor-released patched version is identified in the available data; the only upstream reference is the tracking issue https://github.com/nasa/cFS/issues/1057, so treat any fix as 'released patched version not independently confirmed' and monitor that issue and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-67979) for a tagged release. As compensating controls, restrict write access to the storage paths that ES scans for loadable shared objects (filesystem permissions / read-only mounts for the app-load directory), which prevents attacker-planted objects but requires deploying legitimate apps through a controlled provisioning step; enforce integrity/signature verification or an allowlist of approved application object files before ES loads them, at the cost of added boot-time validation; and lock down the ground/upload and maintenance interfaces that could deliver files to onboard storage, since removing the ability to write the shared object removes the attack.