CISA 2026-07-30

NASA Core Flight System (cFS) Health & Safety (HS) Application

Machine-generated analysis · WAYSCloud LLM

Versions up to 7.0.1 of NASA’s Core Flight System (cFS) Health & Safety (HS) application are vulnerable to a NULL pointer dereference that can cause a denial-of-service.

Context

The affected product is NASA’s Core Flight System (cFS) Health & Safety (HS) application. The advisory states that an incomplete fix for CVE-2026-15352 leaves a NULL pointer dereference reachable, and triggering the affected command can crash the HS application, causing a denial-of-service and processor reset. The vulnerability is present in all versions through 7.0.1 and is rated CVSS 7.5 (high).

Operator considerations

Check: Verify the installed HS application version is 7.0.1 or earlier.
Patch: Apply the interim fix from NASA’s HS repository (dev branch starting at commit 828855f971db4b6714367ed0a970f52dbeab2965).
Log: Monitor system logs for HS application crashes or processor resets.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

The following versions of NASA Core Flight System (cFS) Health & Safety (HS) Application are affected:

Core Flight System (cFS) Health & Safety (HS) Application

Read the full advisory on CISA →