CVE-2026-67979

CriticalCVSS 9.1

Published: 04/08/2026(UTC)Updated: 05/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

In NASA cFS v7.0.1, the Executive Services dynamic application start path component has incorrect access control. An attacker can place a shared object on target storage, allowing arbitrary code execution.

Risk Assessment

The vulnerability allows arbitrary code execution in the cFS system, potentially leading to full system compromise and data integrity violation.

Recommendation

Apply patches provided by NASA for cFS or restrict access to the dynamic application start path to prevent placement of malicious objects.

Original NVD description (English source)

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage.