A serious security vulnerability was identified in a control software program called AIT-GUI, which NASA uses to manage its spacecraft and satellite systems from the ground. According to an investigation by Yuval Elbar, a researcher at cybersecurity firm Cycode, the system was exposed to the internet without requiring users connecting from outside to enter a username or password.
AIT-GUI is used as an interface that allows engineers to send commands to spacecraft. These commands can start the vehicles’ engines, activate cameras and enable scientific instruments to collect data. Because of the vulnerability, people who could establish an ordinary network connection were able to access the system as authorized NASA employees and send commands directly, without needing complex password-cracking methods.
The issue was reportedly caused by a coding error made by the developers, which left the system open not only to the local computer but also to all incoming network requests from outside. This situation also put systems behind firewalls at risk. If a NASA employee visited a malicious website while the control panel was open on their computer, malware could access the panel in the background and send commands to devices in space.
It was reported that no spacecraft or satellite had been harmed before the vulnerability was detected. NASA fixed the software’s access issues with a new update it released. However, if the vulnerability had been exploited by malicious individuals, rockets could have been misdirected, satellites could have been diverted from their trajectories and space missions worth billions of dollars could have been sabotaged by cutting off communication with Earth. The report was published on 21.08.2026.