NASA's Core Flight System has a flaw that can crash spacecraft software

Key points

• CISA disclosed CVE-2026-18064 in NASA's Core Flight System Health and Safety application on 30 July 2026, rated 7.5 on the CVSS 3.1 scale and 8.2 on the newer 4.0 scale.
• The flaw affects all versions of the Health and Safety app up to and including v7.0.1.
• An attacker who can send the right command can crash the app and force a processor reset, taking the affected system offline.
• The bug is an incomplete fix for an earlier vulnerability, CVE-2026-15352, meaning the first patch left a second crash path open.
• NASA has not yet shipped an official release; a working fix sits in the development branch of its public GitHub repository.

A researcher has found a way to crash software that NASA publishes for anyone building spacecraft or satellite systems.

The program is the Core Flight System, or cFS: open-source flight software whose code is published for anyone to read and adapt. Space agencies and private companies build it into the computers that keep vehicles running.

The specific piece at fault is the Health and Safety application, the module that watches over the rest of the system and reacts when something goes wrong. In an advisory published on 30 July 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) said versions up to and including v7.0.1 contain a flaw tracked as CVE-2026-18064.

What can an attacker actually do?

Crash the watchdog. The bug is a null pointer dereference, a coding mistake where the program tries to use a memory address that points to nothing and immediately falls over. An attacker who can send a specific command under the right conditions makes the Health and Safety app die, which triggers a processor reset.

The part of the software meant to notice problems is itself the problem. When it crashes, the computer reboots.

CISA rated the issue 7.5 on CVSS 3.1 and 8.2 on the newer 4.0 scale. Both land firmly in the high band. The attack requires no login and no user interaction, but it only breaks availability, not confidentiality.

Why does this feel familiar?

Because it's the second time around. CVE-2026-18064 is an incomplete fix for CVE-2026-15352. NASA patched the first bug, but the patch left a separate crash path in the same command handler. Michael Holmquist of Hasp Labs spotted the leftover hole and reported it to CISA.

It's a pattern worth watching: a vendor closes the front door and someone finds the window still open. We've seen the same dynamic recently with industrial denial-of-service flaws in Rockwell and Mitsubishi kit, where patches either lagged or hadn't shipped at all.

Is there a patch?

Not in a formal release. NASA says an official fix will land in a future version of the Health and Safety app. Operators who need to act early can pull the latest development branch from the public HS repository on GitHub, where the correction has been committed.

CISA said it's seen no public exploitation of the bug so far.

Should ordinary people worry?

Not directly. CFS runs inside specialist hardware operated by agencies and defence contractors, and CISA lists transportation as the main deployment sector. Consumers won't encounter it.

The wider point matters more. Open-source components sit inside critical systems everywhere: aircraft avionics, hospital pumps, factory floors. When a bug surfaces in one, every downstream operator has to notice, assess and act. That chain is only as strong as its slowest link, and with no formal patch yet, the clock is running.

CISA's standard guidance for industrial systems applies: keep control networks off the public internet, put them behind firewalls, and use VPNs (encrypted tunnels that shield traffic between two points) for remote access.