NASA AIT-Core EUVD-2026-92014

Requires network-level reachability to the ait-server ZeroMQ message bus - specifically TCP port 5559 (XSUB) to publish spacecraft command data onto internal topics including __commands__, and/or TCP port 5560 (XPUB) to subscribe to command and telemetry traffic. The vulnerable state is the DEFAULT configuration in AIT-Core through 3.1.1, where the broker binds XSUB/XPUB to all network interfaces with no authentication or transport security; command forwarding to the uplink UDP path specifically relies on the shipped default command_stream configuration. Limiting factors: the attacker must have a network path to the ground bus (typically an isolated/segmented mission network rather than the internet), and upgrading to 3.1.2 - which binds these sockets to loopback by default - removes remote reachability entirely.

All available signals point to a genuine high-priority issue rather than a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is consistent with the description: the ait-server ZeroMQ broker binds its XSUB/XPUB sockets to all interfaces by default with no authentication or transport security, so any attacker reaching TCP 5559/5560 can publish or subscribe. This is unauthenticated (PR:N confirmed by vector) and requires no user interaction, matching the kill-chain impact of command injection and telemetry exfiltration. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and exploitation probability cannot be quantified. The key mitigating reality not captured in the raw 9.8 is deployment topology: ait-server is spacecraft ground-system software normally run on segmented mission networks, so 'network access to the ZeroMQ bus' in practice means an attacker already positioned on or adjacent to the ground network, not the open internet. Note a cross-reference caveat: one linked advisory (GHSA-3j6g-pxmx-58qg) concerns a DIFFERENT product, AIT-GUI before 2.5.1 (unauthenticated Sessions.create/handle_cmd), not AIT-Core - related missing-auth theme but should not be conflated with this CVE when assessing affected versions.

An attacker with reachability to the mission ground network connects to the ait-server ZeroMQ broker on TCP 5559 and publishes crafted messages onto the __commands__ topic; with the shipped default configuration these are forwarded through command_stream and emitted on the command-uplink UDP path as spacecraft commands. The same attacker can subscribe on TCP 5560 to passively exfiltrate live command and telemetry traffic or inject forged telemetry to mislead operators. No public exploit code was identified in the provided data, but exploitation requires no authentication or special tooling beyond a standard ZeroMQ client.