Critical Auth Flaw Found in AMMOS Toolkit

The AMMOS Instrument Toolkit (AIT) GUI contains a critical missing authentication vulnerability, tracked as CVE-2026-60112. This flaw allows any unauthenticated network attacker to bypass security controls, obtain a valid session, and issue arbitrary spacecraft commands to the command bus.

What's at Risk

The vulnerability affects AIT GUI versions before 2.5.1. Systems running this software are at high risk if they are exposed to the network, as the flaw allows an attacker to interact directly with the command bus without providing credentials. Organizations utilizing this toolkit for mission operations or instrument management should consider any internet-facing instance of the software to be at immediate risk of unauthorized command injection.

How the Flaw Works

Missing authentication vulnerabilities occur when a software interface fails to verify the identity of a user before granting access to sensitive functions. In this class of weakness, an attacker can invoke internal methods or API endpoints that are intended to be protected by an authentication gate. By calling functions like session creation routines without valid credentials, an attacker can effectively impersonate an authorized user. Once a session is illicitly established, the application treats the attacker's requests as legitimate, allowing the unauthorized execution of arbitrary commands or access to restricted system data. This type of failure effectively removes the boundary between an untrusted external actor and the internal logic of the application.

How to Protect Your Systems

• Update the AMMOS Instrument Toolkit (AIT) GUI to version 2.5.1 or later immediately.
• Review the vendor-provided changelog and commit history to ensure all security patches are fully applied.
• Restrict network access to the AIT GUI to authorized personnel only, utilizing firewalls or VPNs to prevent public exposure.
• Implement network segmentation to isolate command-and-control interfaces from broader, less secure network segments.
• Monitor system logs for unauthorized access attempts or unexpected calls to session management endpoints.

With a CVSS score of 9.8, this vulnerability represents an extreme risk to operational integrity. Because the flaw provides a direct path to issuing commands without any authentication, prompt patching is the only effective way to eliminate the exposure. Organizations must prioritize the upgrade to version 2.5.1 to ensure that the command bus remains protected against unauthorized access.