NASA's Core Flight System has a flaw that can crash spacecraft software

Key points

• CISA disclosed CVE-2026-18064 in NASA's Core Flight System Health and Safety application on 30 July 2026, rated 7.5 on the older CVSS 3.1 scale and 8.2 on the newer 4.0 scale.
• The flaw affects all versions of the Health and Safety app up to and including v7.0.1.
• An attacker who can send the right command can crash the app and force a processor reset, taking the affected system offline.
• The bug is an incomplete fix for an earlier vulnerability, CVE-2026-15352, meaning the first patch left a second crash path open.
• NASA has not yet shipped an official release; a working fix sits in the development branch of its public GitHub repository.

A researcher has found a way to crash a piece of software that NASA gives away for free to anyone building a spacecraft, drone or satellite system.

The program is called the Core Flight System, or cFS. It is open-source flight software, meaning the code is published for anyone to read, reuse and adapt. Space agencies, universities and private companies build it into the computers that keep vehicles running.

The specific piece at fault is the Health and Safety application, the module that watches over the rest of the system and reacts when something goes wrong. In an advisory published on 30 July 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) said versions up to and including v7.0.1 contain a flaw tracked as CVE-2026-18064.

What can an attacker actually do?

Crash the watchdog. The bug is a null pointer dereference, a common coding mistake where the program tries to use a memory address that points to nothing and immediately falls over. An attacker who can send a specific command under the right conditions makes the Health and Safety app die, which then triggers a processor reset.

In plain terms: the part of the software meant to notice problems is itself the problem. When it crashes, the computer running it reboots.

CISA rated the issue 7.5 on the older CVSS 3.1 severity scale and 8.2 on the newer 4.0 scale. Both put it firmly in the "high" band. The attack can be launched over a network with no login and no user interaction, but it only breaks availability, not confidentiality.

Why does this feel familiar?

Because it is the second time around. The advisory notes that CVE-2026-18064 is an incomplete fix for an earlier flaw, CVE-2026-15352. NASA patched the first bug, but the patch left a separate crash path in the same command handler. The researcher, Michael Holmquist of Hasp Labs, spotted the leftover hole and reported it to CISA.

Incomplete fixes are a running theme in security research. A vendor closes the front door and someone finds the window still open.

Is there a patch?

Not in a formal release yet. NASA says an official fix will land in a future version of the Health and Safety app. For now, operators who need to act early can pull the latest development branch from the public HS repository on GitHub, where the correction has been committed.

CISA said it has seen no public exploitation of the bug so far.

Should ordinary people worry?

Not directly. This is not a consumer product. cFS runs inside specialist hardware operated by space agencies, defence contractors and research groups, and CISA lists the transportation sector as the main area of deployment. Ordinary passengers, patients or shoppers will not encounter it.

The wider lesson is more useful. Open-source components sit inside critical systems everywhere, from aircraft avionics to hospital pumps. When a bug turns up in one, every downstream operator has to notice, assess and patch. That chain is only as strong as its slowest link.

CISA's standard advice for industrial systems still applies: keep control networks off the public internet, put them behind firewalls, and use VPNs (encrypted tunnels that shield traffic between two points) for any remote access.