Critical severity · published Jul 29, 2026
CVE-2026-60113
AIT-DSN < 2.2.2 Missing Authentication via SLE API Routes
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AIT-DSN · NASA-AMMOS
before 2.2.2 · source: vendor
AD
Ait Dsn · Nasa
before 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-60113
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-60113
Release Notes
https://github.com/NASA-AMMOS/AIT-DSN/blob/master/CHANGELOG.md#222---2026-07-13
Patch
https://github.com/NASA-AMMOS/AIT-DSN/commit/06d07d1a525602c62c6eaeaeff2544196f430340
Product
https://github.com/NASA-AMMOS/AIT-DSN/releases/tag/2.2.2
Exploit
https://github.com/NASA-AMMOS/AIT-DSN/security/advisories/GHSA-gj83-67wr-82mv
Patch
https://www.vulncheck.com/advisories/ait-dsn-missing-authentication-via-sle-api-routes