PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60112 NASA-AMMOS CVE debrief

AIT GUI before 2.5.1 has a missing authentication vulnerability allowing unauthenticated network attackers to obtain valid sessions and issue arbitrary spacecraft commands. This vulnerability enables attackers to bypass authentication mechanisms and gain unauthorized access to the system. Organizations should be aware of the potential risks and take necessary actions to mitigate the vulnerability. The vulnerability affects AIT GUI versions prior to 2.5.1 and can be mitigated by applying the patch or updating to version 2.5.1 or later. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems, review system configurations, and implement additional authentication mechanisms.

Vendor
NASA-AMMOS
Product
AIT-GUI
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-29
Original CVE updated
2026-08-18
Advisory published
2026-07-29
Advisory updated
2026-08-18

Who should care

Organizations using AIT GUI versions prior to 2.5.1 should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators, platforms, and security teams should review system configurations, implement additional authentication mechanisms, and monitor for potential exploitation.

Technical summary

The AIT GUI before version 2.5.1 contains a missing authentication vulnerability. This allows any unauthenticated network attacker to obtain a valid session by calling Sessions.create() without any credential check. Subsequently, attackers can invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch. The vulnerability affects AIT GUI versions prior to 2.5.1 and can be mitigated by applying the patch or updating to version 2.5.1 or later.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from https://github.com/NASA-AMMOS/AIT-GUI/commit/beb8fc0813eded89f985d3eb9a73535dd327726d
  • Update to AIT GUI version 2.5.1 or later
  • Review system configurations for potential vulnerabilities
  • Implement additional authentication mechanisms
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-60112 record and NVD detail provide information on the vulnerability. The AIT GUI version 2.5.1 changelog, patch commit, and release notes offer mitigation details. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems, review system configurations, and implement additional authentication mechanisms.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60112 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60112

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60112 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60112

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.