CVE-2026-18064: NASA cFS Health & Safety DoS — Detection and Hardening

By Senior Security Consultant, Security Arsenal

Introduction

Defenders managing Operational Technology (OT) and space-flight ground systems must immediately address a new high-severity vulnerability affecting the NASA Core Flight System (cFS). CISA advisory ICSA-26-211-06 details CVE-2026-18064, a NULL pointer dereference flaw in the cFS Health & Safety (HS) application. This issue is particularly dangerous because it represents an incomplete fix for a prior vulnerability (CVE-2026-15352), suggesting persistent difficulties in sanitizing inputs within this critical codebase.

Successful exploitation allows an attacker to trigger a Denial-of-Service (DoS) condition. In the context of Transportation Systems and aerospace infrastructure—where cFS is deployed—disabling the Health & Safety monitoring subsystem can obscure critical system faults, leading to cascading failures or unsafe operational states. With a CVSS v3 score of 7.5, this is not a theoretical risk; it is a concrete availability threat requiring immediate validation and remediation.

Technical Analysis

Affected Products and Scope

• Vendor: NASA
• Product: Core Flight System (cFS) Health & Safety (HS) Application
• Affected Versions: <= v7.0.1
• Critical Infrastructure Sector: Transportation Systems

Vulnerability Mechanics (CVE-2026-18064)

The vulnerability stems from a NULL Pointer Dereference.

1. The Flaw: The HS application is responsible for monitoring the health of the flight software. A previous fix for CVE-2026-15352 attempted to address a similar memory access issue but failed to cover all code paths.
2. Trigger: An attacker can supply specific input or trigger a specific state where the application attempts to read or write to a memory address that is NULL (0x00000000).
3. Impact: This causes the operating system to throw a segmentation fault (SIGSEGV), terminating the HS application immediately.
4. Consequence: Loss of health monitoring creates a blind spot. Furthermore, if a watchdog mechanism is configured to restart the entire system upon HS failure, this could result in a full system reboot, causing a complete DoS of the transportation or flight control node.

Exploitation Status

While CISA has not confirmed active exploitation in the wild at the time of this advisory, the public availability of the cFS source code and the specifics of the "incomplete fix" significantly lower the barrier for attackers to develop a reliable exploit. The complexity is low, requiring only the ability to interact with the HS application's input interface.

Detection & Response

Detecting NULL pointer dereferences often relies on observing the crash (availability impact) rather than the exploit attempt itself. For embedded systems running cFS (often on Linux or VxWorks), we look for abnormal terminations of the hs or hs_app process.

Sigma Rules

The following rules target the process crash behavior characteristic of this vulnerability on Linux-based endpoints hosting cFS.

---
title: NASA cFS HS Application Crash (Segfault)
id: 8a1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects a segmentation fault or abort of the NASA cFS Health & Safety (HS) application, indicative of CVE-2026-18064 exploitation.
references:
 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t1499
logsource:
 product: linux
 service: syslog
detection:
 selection:
 program|contains:
   - 'kernel'
   - 'hs_app'
   - 'core_flight'
 message|contains:
   - 'segfault'
   - 'NULL pointer dereference'
   - 'general protection fault'
 condition: selection
falsepositives:
 - Application instability due to hardware faults
level: high
---
title: NASA cFS HS Process Restart Loop
id: 9b2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects rapid restarts of the cFS HS process, suggesting a persistent DoS attempt.
references:
 - https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-06
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t1499
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 Image|endswith: '/hs'
   OR
   Image|endswith: '/hs_app'
 timeframe: 1m
 condition: selection | count() > 5
falsepositives:
 - Legitimate debugging or rapid deployment cycles
level: medium

KQL (Microsoft Sentinel)

Use this query to hunt for crash signatures or abnormal process terminations in Syslog ingested from OT Linux servers or gateways.

// Hunt for cFS HS Application Crashes
Syslog
| where ProcessName contains "hs" or ProcessName contains "cFS"
| where SyslogMessage has_any ("segfault", "SIGSEGV", "NULL pointer", "aborted")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, FacilityLevel
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for the existence of the HS binary and checks for recent core dump files which might indicate a crash.

-- Hunt for NASA cFS HS binaries and recent core dumps
SELECT 
  FullPath,
  Size,
  Mode.String AS Mode,
  Mtime AS ModifiedTime
FROM glob(globs="/usr/local/bin/hs")

SELECT 
  FullPath,
  Size,
  Mtime AS ModifiedTime
FROM glob(globs="/var/crash/core*", root="/")
WHERE ModifiedTime > now() - 1h

Remediation Script (Bash)

This script assists in identifying the current version of the installed HS application to verify if it is vulnerable.

#!/bin/bash
# Remediation Check for CVE-2026-18064
# Checks version of NASA cFS HS Application

HS_BIN_PATH="/usr/local/bin/hs"
CFS_VERSION_FILE="/opt/cfs/VERSION"

if [ -f "$HS_BIN_PATH" ]; then
    echo "[+] NASA cFS HS Application detected at: $HS_BIN_PATH"
    # Attempt to extract version info (method varies by build config)
    strings "$HS_BIN_PATH" | grep -i "version" | head -5
    
    if [ -f "$CFS_VERSION_FILE" ]; then
        echo "[+] Version file found:" 
        cat "$CFS_VERSION_FILE"
    else
        echo "[-] Standard version file not found. Manual inspection required."
        echo "    Check if build version is > v7.0.1"
    fi
else
    echo "[+] HS Application not found at standard location."
fi

Remediation

1. Patch Immediately: Update the NASA Core Flight System (cFS) Health & Safety (HS) Application to a version newer than v7.0.1. Apply the patch provided by the vendor or via the official NASA cFS repository.
2. Validate the Fix: Ensure that the patch specifically addresses the incomplete fix for CVE-2026-15352.
3. Network Segmentation: Ensure that cFS ground nodes and transportation system controllers are isolated from untrusted networks. The HS application should not be exposed to public-facing interfaces.
4. Review Watchdog Configurations: If your system uses a watchdog to restart the HS app upon failure, verify that it logs the restart reason. This provides forensic evidence if the DoS occurs again before patching.

Vendor Advisory: CISA ICSA-26-211-06

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub