CVE-2026-105105 NASA-AMMOS AIT-Core - Authentication Bypass

NASA-AMMOS AIT-Core <= 3.1.1 contains missing authentication for critical functions caused by unauthenticated ZeroMQ message bus sockets binding to all interfaces, letting unauthenticated remote attackers inject or exfiltrate spacecraft command and telemetry data, exploit requires network access to TCP ports 5559 or 5560.

CVSS base score 9.8 /10
Critical
CISA KEV
Not listed
Public exploit
None known
EPSS
0.78% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Authentication Bypass
Impact
Data Tampering, Information Disclosure, Denial Of Service
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
3 October 2026
Updated
15 October 2026
Weakness
CWE-306

Vendor fix

Update to version 3.1.2 or later which restricts ZeroMQ bind addresses to loopback.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs