High 7.5Published Jul 30, 2026

CVE-2026-18064NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

Updated under an hour ago (Oct 27, 2026, 6:30 AM ET)

Does this affect you?

It affects NASA Core Flight System (cFS) Health & Safety (HS) Application. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for NASA Core Flight System (cFS) Health & Safety (HS) Application

Exploited in the last 30 days

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: icscert
NVD analysis: Awaiting Analysis
Record last updated: Jul 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

NASA Core Flight System (cFS) Health & Safety (HS) Application nasa:core_flight_system_cfs_health_and_safety_hs_application (from the name)	through v7.0.1	CNA record

References

References

https://github.com/nasa/HS
https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-06.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.