Critical 9.8Published Oct 3, 2026

CVE-2026-105105Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects NASA-AMMOS AIT-Core. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.78%, higher than 55% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for NASA-AMMOS AIT-Core

Exploited in the last 30 days

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-server ZeroMQ broker binds its XSUB and XPUB sockets to all network interfaces by default without authentication or transport security. An attacker able to reach TCP port 5559 can publish messages onto internal topics, including the __commands__ command topic. With the shipped default configuration, command messages are forwarded through command_stream and emitted on the command-uplink UDP path. An attacker able to reach TCP port 5560 can subscribe to command and telemetry traffic on the ground bus. AIT-Core 3.1.2 changes the default ZeroMQ bind addresses to loopback.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.78% (percentile 55)
Assigned by: TuranSec
NVD analysis: Awaiting Analysis
Record last updated: Oct 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

NASA-AMMOS AIT-Core nasa_ammos:ait_core (from the name)	through 3.1.1	CNA record

References

https://github.com/NASA-AMMOS/AIT-Core/security/advisories/GHSA-ccw5-g774-3683
https://github.com/NASA-AMMOS/AIT-Core/
https://github.com/advisories/GHSA-9xfm-37f4-2h8g
https://github.com/Mothra-1

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.