CISA has issued a high‑severity advisory for a vulnerability in NASA’s Core Flight System Health and Safety application that can force a processor reset, disrupting critical flight and embedded systems. The flaw, tracked as CVE‑2026‑18064, affects all versions through 7.0.1 and has no official patch—only a source‑level development branch fix.

Published on July 30, the advisory warns that an incomplete correction for an earlier bug (CVE‑2026‑15352) leaves a separate null pointer dereference reachable when a specially crafted command is processed. A successful exploit crashes the HS application, which in turn triggers a full processor reset. The result is a denial‑of‑service condition rated at CVSS 3.1 base score 7.5 (HIGH) and CVSS 4.0 base score 8.2 (HIGH).

The Vulnerability: A Leftover Null Pointer Dereference

The Health and Safety (HS) application is not a Windows component—it runs inside NASA’s open‑source Core Flight System (cFS), a framework used in satellites, launch vehicles, drones and other embedded, safety‑critical platforms. HS’s job is to monitor software health and, if it detects an anomaly, trigger a controlled processor reset. Now, an attacker who can reach the affected command—under conditions not yet fully detailed—can cause the HS application itself to crash, forcing an unplanned reset.

CISA’s advisory describes the attack as network‑reachable with low complexity and no authentication or user interaction required. The metrics (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) should not be interpreted as every cFS deployment being exposed to the public internet. Instead, they highlight why any command path—whether across a shared test network, a ground‑control link or a remote engineering VPN—must be reviewed immediately.

Who Is Affected? Not Windows, but Engineering Workstations May Be a Pathway

Typical Windows PCs are not directly vulnerable. However, many teams build, test and manage cFS environments from Windows‑based engineering workstations. If those workstations sit on a flat network with the flight‑software testbeds or operational ground segments, they become a potential route into the affected HS application. The real danger lies in embedded, autonomous systems where a processor reset can interrupt telemetry, abort sequences or silence health monitoring at a critical moment.

Organizations should think of this threat in layers:
- Flight‑software engineers who maintain cFS bundles and compile the HS app will need to apply the source‑level fix.
- Integration testers must regression‑test the patched HS against their full cFS stack and mission configuration tables.
- System administrators managing ground‑segment networks should enforce strong network segmentation and access controls, even before the code is updated.

Why an Incomplete Fix Created a New DoS Path

CVE‑2026‑18064 is a direct consequence of a previous vulnerability, CVE‑2026‑15352, which also involved a null pointer dereference in the HS application. NASA’s original patch closed one code path but overlooked another. According to CISA, Michael Holmquist of Hasp Labs reported the residual flaw.

The commit that remedies CVE‑2026‑18064 is labeled “Add table access protections” (commit 828855f971db4b6714367ed0a970f52dbeab2965) and sits in the dev branch of NASA’s HS GitHub repository. It touches command handling and monitoring structures, adding guards where they were missing. Notably, the fix is not yet packaged in a formal release—engineering teams must pull the changes directly from the development branch, build them and integrate the result into their own cFS distribution.

Immediate Steps: Lock Down Networks, Then Apply the Dev Commit

There is no viable alternative to updating the HS application, but rushing the source‑level fix without proper testing is risky. CISA recommends these containment measures while you prepare a controlled software update:

  1. Inventory every HS deployment—especially versions ≤ 7.0.1 that accept commands over a network. Don’t forget test harnesses, integration labs and flight‑like simulators.
  2. Minimize network exposure. Move cFS systems and their command interfaces behind firewalls, isolated from business LANs and the internet. If remote access is absolutely required, route it through a VPN that is itself patched and uses multi‑factor authentication.
  3. Restrict command access. Only authorised operators should be able to send the vulnerable command type. Review access control lists on ground‑station software, telemetry gateways and any web‑based monitoring dashboards.
  4. Apply the dev‑branch fix in a controlled way. Clone the HS repo, check out the dev branch and verify you are on or beyond commit 828855f. Diff the changes, rebuild against your specific cFS bundle, and run a full regression in a hardware‑in‑the‑loop configuration. Confirm that health‑monitoring triggers, reset handling and table‑based parameters all behave as expected.
  5. Harden Windows engineering hosts. Even though they aren’t the vulnerable component, make sure they are fully patched, run anti‑malware and are not able to directly reach the HS command port without going through a secured jump host.

What Comes Next: Official Patch Still in Development

NASA has confirmed that an official release containing the fix is under development but no date has been given. The interim mitigation from the dev branch is functionally adequate, but it carries the stamp of development code—engineering teams must weigh the risk of an unplanned reset against the risk of introducing instability from unreleased software. In most safety‑critical environments the reset risk will outweigh the code‑maturity concern, but each mission should make that call through its own change‑control board.

CISA reports no known exploitation of CVE‑2026‑18064 as of July 30, 2026. That window of opportunity is shrinking, however. Once exploit details circulate, any network‑accessible HS instance that hasn’t been updated or firewalled off becomes a target. Teams that act now—segmenting networks, reviewing command paths and lining up the dev‑branch fix—will be positioned to apply the official release quickly when it lands.

The situation also highlights a broader lesson for embedded open‑source supply chains: a vulnerability deep in a trusted component can ripple into systems that are difficult to update quickly. Keeping a tight inventory and insisting on regression‑ready testbeds is no longer optional—it’s fundamental cyber‑hygiene for the flight‑software community.