CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-60112 — AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authenticatio...

·Source: NIST NVD

Updated:

Executive Summary

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward ar

Analysis

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward arbitrary commands directly to the AIT command bus without any authentication gate between session creation and command dispatch. CVSS Score: 9.8. Published: 2026-07-29T16:17:55.413.

Indicators of Compromise (1)

CVE (1)
CVE-2026-60112
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 29, 2026. Verified by: NIST.

Related Threats

HIGHVulnerability

NVD HIGH: CVE-2026-67201 — V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery...

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.

CVE-2026-67201
NIST NVD
CRITICALVulnerability

NVD CRITICAL: CVE-2026-14529 — IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv...

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

CVE-2026-14529
NIST NVD
MEDIUMVulnerability

AI Attacks Turn Bank Breaches Into a 'Hostage Situation'

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/ai-attacks-turn-bank-breaches-into-hostage-situation-image_small-1-a-32359.jpg" align=right hspace=4><b>TrendAI's Tom Kellermann on Autonomous Attack Response, AI Governance Practices</b><br>Cybercrime groups are using AI to automate attacks, disrupt incident response and maintain control of financial networks. Tom Kellermann of T

Bank Info Security