PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92153 nasa CVE debrief

CVE-2026-92153 debrief based on the supplied source corpus. The F´ (F Prime) framework has a vulnerability in Svc::FileUplink handling, allowing for arbitrary file writes via attacker-controlled StartPacket.destinationPath. This issue affects integrity and potentially availability. Defenders should assess exposure and potential impact. Verification of exposure and assessment of potential impact are crucial. The CVE record was published on 2026-10-14T16:28:18.673Z and has not been modified since then.

Vendor
nasa
Product
fprime
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-15
Advisory published
2026-10-14
Advisory updated
2026-10-15

Who should care

Defenders responsible for F´ (F Prime) framework deployments should assess exposure and potential impact. They should verify if the system uses affected versions of F´ (F Prime) framework and assess potential exposure to attacker-controlled file uplink packets. Defenders should also monitor for suspicious file system activity and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

Defenders should care about CVE-2026-92153 as it affects F´ (F Prime) framework, potentially allowing for arbitrary file writes and impacting integrity and availability. Verification of exposure and assessment of potential impact are crucial.

  • Potential integrity impact due to arbitrary file writes.
  • Potential availability impact due to file system modifications.
  • Verification of exposure and impact is required.

Technical summary

F´ (F Prime) framework has a vulnerability in Svc::FileUplink handling, allowing for arbitrary file writes via attacker-controlled StartPacket.destinationPath. The issue affects integrity and potentially availability. The vulnerability is fixed in version 4.3.0. Defenders should assess exposure and potential impact. Verification of exposure and assessment of potential impact are crucial. The CVE record and source item provide details on the vulnerability and its impact. The vulnerability allows for arbitrary file writes, potentially affecting integrity and availability.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

  • Verify if the system uses affected versions of F´ (F Prime) framework.
  • Assess potential exposure to attacker-controlled file uplink packets.
  • Update to version 4.3.0 or later if vulnerable.
  • Monitor for suspicious file system activity.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability in F´ (F Prime) framework, specifically in Svc::FileUplink handling. The vulnerability allows for arbitrary file writes via attacker-controlled StartPacket.destinationPath. The issue is fixed in version 4.3.0. Defenders should verify exposure and assess potential impact. The source item and CVE record provide evidence of the vulnerability and its impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92153 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92153

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92153 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92153

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/92xxx/CVE-2026-92153.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/security/advisories/GHSA-5rfj-hw2g-vwmv

    Supplemental source - x_refsource_CONFIRM

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/pull/5320

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/commit/4c8b9c0b8692b0d47cbd5f2ccec61c74aa02b893

    Supplemental source - x_refsource_MISC

  • Source reference

    Unverified legacy reference

    URL: https://github.com/nasa/fprime/releases/tag/v4.3.0

    Supplemental source - x_refsource_MISC

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.