CVE-2026-60112 describes a missing authentication vulnerability in NASA-AMMOS AIT-GUI before version 2.5.1. The Sessions.create() function can be called by unauthenticated attackers to obtain a valid session. Subsequently, attackers can use handle_cmd() to forward arbitrary commands to the AIT command bus without any authentication gate, effectively allowing unauthorized command execution on spacecraft systems. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can gain a valid session and issue arbitrary commands to spacecraft systems, potentially compromising mission operations and control. The lack of authentication checks between session creation and command dispatch means attackers can fully control command execution, posing a critical risk to spacecraft safety and mission integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the AIT-GUI interface to trusted users only and monitor for unauthorized access attempts. Avoid exposing the AIT-GUI to untrusted networks. Follow vendor updates closely for patches or official mitigations.