NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

NASA's AIT-GUI spacecraft control software contains critical unauthenticated command injection vulnerabilities (CVSS 9.4) allowing attackers to execute arbitrary commands and scripts without authentication. Any organization running AIT-GUI versions below 2.5.2 is at immediate risk of losing control of spacecraft systems or connected instruments. The patched version exists but most deployed instances are still on vulnerable 2.4.1 from PyPI.

CRITICALAdvisoryAug 20, 2026

Action required

Identify all systems running AIT-GUI in your environment immediately. Upgrade to version 2.5.2 or newer without delay. If you cannot patch within 24 hours, isolate affected systems from network access until patching is complete.

Affected products

NASAAIT-GUICycode

Linked articles

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Source links

https://thehackernews.com/2026/08/nasa-ait-gui-flaws-could-let.html