Is CVE-2026-15352 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15352 being exploited in the wild.

How severe is CVE-2026-15352?

High severity, with a CVSS score of 7.5, published 16 July 2026.

Which products and versions are affected?

Nasa Core Flight System Health & Safety Application < v7.0.1.

Is there a fix for CVE-2026-15352?

A patch was published on 2026-05-14: Version v7.0.1 released on GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15352 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-15352?

Check whether you run Nasa Core Flight System Health & Safety Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15352: NASA Core Flight System NULL pointer dereference in HS application

Q: Is there a fix for CVE-2026-15352?

A patch was published on 2026-05-14: Version v7.0.1 released on GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-15352 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-15352?

Check whether you run Nasa Core Flight System Health & Safety Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15352 · Severity: high · CVSS 7.5 · Published 2026-07-16

A vulnerability exists in the Health & Safety application of NASA's Core Flight System, which is a foundational software framework used in satellite and spacecraft missions. An attacker could remotely trigger a system crash by sending a routine telemetry request, potentially leading to a loss of spacecraft monitoring or control capabilities. This issue causes a denial-of-service condition that could disrupt mission operations.

Vendors: Nasa.

Quick answers

Is CVE-2026-15352 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15352 being exploited in the wild.
How severe is CVE-2026-15352?: High severity, with a CVSS score of 7.5, published 16 July 2026.
Which products and versions are affected?: Nasa Core Flight System Health & Safety Application < v7.0.1.
Is there a fix for CVE-2026-15352?: A patch was published on 2026-05-14: Version v7.0.1 released on GitHub. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15352 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-15352?: Check whether you run Nasa Core Flight System Health & Safety Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A NULL pointer dereference (CWE-476) exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The vulnerability is triggered when the application processes a routine Housekeeping Telemetry request, leading to a segmentation fault and subsequent application crash. The attack can be executed over the network without authentication or user interaction. Successful exploitation results in a denial-of-service (DoS) condition for the HS application, which is responsible for monitoring the status of the flight system. NASA has released version v7.0.1 to address this flaw.

Affected products

NASA Core Flight System (cFS) Health & Safety (HS) Application < v7.0.1

Timeline

2026-07-16: advisory: CISA and NVD published the advisory.
2026-05-14: patched: Version v7.0.1 released on GitHub.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.