Which versions of AIT-GUI are affected by EUVD-2026-50396?

NASA-AMMOS AIT-GUI before version 2.5.1 contains a critical vulnerability allowing unauthenticated remote attackers to gain session access and send arbitrary commands to spacecraft systems.. A patch is available.

How to fix or mitigate EUVD-2026-50396?

Within 24 hours, identify all systems running NASA-AMMOS AIT-GUI versions prior to 2.5.1 and immediately restrict network access to these systems to authorized operational personnel only. Within 7 days, deploy the vendor-released patch to upgrade all instances to version 2.5.1 or later, with testing in non-production environments first. Within 30 days, validate patch deployment across all systems, review audit logs for any unauthorized session creation or command execution, and document remediation completion.

AIT-GUI EUVD-2026-50396

Q: What is the CVSS score of EUVD-2026-50396?

EUVD-2026-50396 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-60112 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-29 VulnCheck

GHSA-3j6g-pxmx-58qg

Authentication Bypass Ait Gui Nasa Ammos

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network attacker obtains a session and commands the bus with no interaction (AV:N/AC:L/PR:N/UI:N); command control yields high C/I/A within the vulnerable system, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 16:26 vuln.today

Analysis Generated

Jul 29, 2026 - 16:26 vuln.today

CVE Published

Jul 29, 2026 - 15:35 cve.org

CRITICAL 9.3

DescriptionCVE.org

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch.

AnalysisAI

Missing authentication in NASA-AMMOS AIT-GUI before 2.5.1 lets any unauthenticated network attacker mint a valid session via Sessions.create() and then push arbitrary commands onto the spacecraft command bus through handle_cmd(). Because no credential check gates session creation and no authorization gate sits between session issuance and command dispatch, a remote attacker can issue arbitrary spacecraft commands. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

AIT-GUI is the web front-end of the AMMOS Instrument Toolkit (AIT), a Python-based framework used to build ground software for commanding and telemetry of spacecraft and instruments. The GUI exposes server-side handlers, including a Sessions.create() endpoint that establishes an interactive session and a handle_cmd() handler that forwards operator commands to the underlying AIT command bus. The root cause is CWE-306 (Missing Authentication for a Critical Function): Sessions.create() issues a valid session without verifying any credential, and the command-dispatch path performs no independent authorization, so reaching handle_cmd() with a self-created session is sufficient to command the bus. The affected component is identified by CPE cpe:2.3:a:nasa-ammos:ait-gui, all versions prior to 2.5.1.

RemediationAI

Vendor-released patch: AIT-GUI 2.5.1 - upgrade to 2.5.1 or later, which is the primary and authoritative fix (release notes: https://github.com/NASA-AMMOS/AIT-GUI/releases/tag/2.5.1; changelog: https://github.com/NASA-AMMOS/AIT-GUI/blob/2.5.1/CHANGELOG.md; fix commit: https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d). If immediate upgrade is not possible, restrict network reachability of the AIT-GUI server by binding it to localhost or a dedicated management interface and placing it behind a firewall or reverse proxy that enforces authentication (e.g., mutual TLS or an authenticating proxy) in front of the Sessions.create() and command endpoints; be aware this front-end auth layer must be maintained separately and can break legitimate operator tooling that expects the unauthenticated interface. As a further compensating control, isolate the ground-system host on an out-of-band operations VLAN with strict allow-listing of operator workstations, accepting the operational overhead of tighter network segmentation. See the VulnCheck advisory (https://www.vulncheck.com/advisories/ait-gui-missing-authentication-via-sessions-create) for authoritative details.