Critical Denial‑of‑Service in NASA Core Flight System (cFS) Health & Safety Application (CVE‑2026‑15352)
What It Is — A null‑pointer dereference in the Health & Safety (HS) component of NASA’s Core Flight System (cFS) can be triggered by a crafted Housekeeping Telemetry request, causing the application to crash with a segmentation fault.
Exploitability — The vulnerability is publicly disclosed (CVE‑2026‑15352) with a CVSS v3 base score of 7.5 (High). No public exploit code has been released, but the flaw is trivial to trigger with a malformed request.
Affected Products — NASA Core Flight System (cFS) Health & Safety (HS) Application, all versions < v7.0.1 (source code hosted on GitHub).
Why It Matters for Compliance & Audit Readiness
- Control Mapping: The DoS condition highlights a gap in the “System Operations” and “Change Management” controls (SOC 2 CC6.1, CC7.2). Mapping this vulnerability to those controls demonstrates due‑diligence and provides concrete evidence for auditors.
- Continuous Evidence Collection: Updating to the patched release and recording the change in a version‑control audit log creates immutable proof that the organization is actively managing known defects.
- Defensible Audit Trail: Documenting the remediation timeline (discovery → patch deployment → verification) satisfies the “Monitoring” and “Incident Response” criteria that enterprise buyers now demand in SOC 2 examinations.
Recommended Actions
- Patch Immediately – Pull the v7.0.1 release from the official NASA GitHub repository and replace the vulnerable HS binary.
- Validate the Fix – Run regression tests that simulate Housekeeping Telemetry requests to confirm the segmentation fault no longer occurs.
- Map to SOC 2 Controls – Record the vulnerability, remediation steps, and test results against CC6.1 (System Operations) and CC7.2 (Change Management) in your compliance management tool.
- Enable Continuous Monitoring – Integrate the HS repository into your CI/CD pipeline with automated vulnerability scanning to surface future CVEs early.
Source: CISA Advisory – ICSA‑26‑197‑03