Advisories › NASA › ICSA-26-211-06
NASA Core Flight System (cFS) Health & Safety (HS) Application: 1 CVE, High 7.5
Summary
CISA reports 1 vulnerability in NASA Core Flight System (cFS) Health & Safety (HS) Application. Weakness type: NULL Pointer Dereference. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
What to do: Prioritize: NASA reports that an official fix is currently under development and is expected to be included in a future software release.
At a glance
- Vendor
- NASA
- Products
- Core Flight System (cFS) Health & Safety (HS) Application
- CVEs
- CVE-2026-18064
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-18064 | NULL Pointer Dereference | 7.5 | – | No | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset. |
Affected products (1)
- NASA Core Flight System (cFS) Health & Safety (HS) Application: <=v7.0.1
Vendor fixes and mitigations (from advisory)
- Mitigation: NASA reports that an official fix is currently under development and is expected to be included in a future software release.
- Mitigation: As an interim mitigation, users can update their HS app from the HS repo (https://github.com/nasa/HS) to the latest dev branch. The fix is in the dev branch starting at commit 828855f971db4b6714367ed0a970f52dbeab2965 link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.