CVE-2026-105105 NASA-AMMOS CVE debrief

Who should care

Defenders responsible for systems with network access to TCP ports 5559 and 5560, especially those using NASA-AMMOS AIT-Core, should assess exposure and verify remediation. This includes operators managing affected deployments, platform administrators, vulnerability management teams, and security teams that need to prioritize and track remediation efforts.

Why it matters

CVE-2026-105105 is a critical vulnerability in NASA-AMMOS AIT-Core, allowing an unauthenticated remote attacker to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. Defenders should assess exposure and verify remediation, especially for systems with network access to TCP ports 5559 and 5560.

• Potential injection of spacecraft command data
• Exfiltration of command and telemetry traffic
• Injection of forged telemetry data
• Disruption of command and telemetry bus

Technical summary

The ait-server ZeroMQ broker in NASA-AMMOS AIT-Core through version 3.1.1 binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. This allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus.

Defensive priority

High priority for defenders to assess exposure and verify remediation, especially for systems with network access to TCP ports 5559 and 5560.

Recommended defensive actions

• Assess exposure by verifying network access to TCP ports 5559 and 5560
• Verify current version of AIT-Core and check for updates
• Implement authentication and transport security for ZeroMQ broker
• Monitor command and telemetry traffic for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in AIT-Core through version 3.1.1. Version 3.1.2 changes the default ZeroMQ bind addresses to loopback, mitigating the vulnerability. However, the supplied corpus does not provide information on all potentially affected versions or configurations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.