CVE-2026-60113 NASA-AMMOS CVE debrief

Who should care

Organizations using AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface, especially those managing Deep Space Network communication sessions and telemetry data, should be aware of this critical vulnerability and take immediate action to patch their systems.

Technical summary

The AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager. This allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. The exposed SLE endpoints can be used to start or stop Deep Space Network communication sessions, retrieve telemetry frame data, and inject arbitrary frames into active spacecraft links.

Defensive priority

Organizations using AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2 should prioritize immediate patching to prevent potential unauthorized access to Deep Space Network communication sessions and telemetry data.

Recommended defensive actions

• Apply the patch by upgrading to version 2.2.2 or later
• Review and restrict access to the SLE interface manager
• Monitor API routes for suspicious activity
• Implement additional authentication mechanisms for API routes
• Verify system inventory and perform vulnerability checks

Evidence notes

The CVE-2026-60113 record indicates a critical vulnerability in AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before version 2.2.2. The vulnerability is due to a missing authentication mechanism in the Space Link Extension (SLE) interface manager, allowing unauthenticated network attackers to access seven unprotected API routes. Limited information is available on the exact scope of affected systems and potential exploitability.

Official resources