Access Control Flaw in NASA cFS v7.0.1
CVE-2026-67979

9.1CRITICAL

Key Information:

Vendor

NASA

Status
cFS
Vendor
CVE Published:
4 August 2026

What is CVE-2026-67979?

The Executive Services component of NASA's cFS v7.0.1 exhibits an incorrect access control vulnerability. This issue permits attackers to exploit the dynamic application start path by placing malicious shared objects onto target storage. Successful exploitation could lead to unauthorized execution of arbitrary code, potentially compromising the integrity and security of the affected system.

References

https://github.com/nasa/cFS/issues/1057

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.