Security experts at Cycode have revealed a series of vulnerabilities in NASA's AIT-GUI, used in the AMMOS Instrument Toolkit, that could allow unauthorized attackers to send commands to spacecraft. This chain of flaws, identified as GHSA-p9r8-2q67-fp86 and carrying a severe CVSS score of 9.4, affects versions 2.5.1 and earlier, with version 2.5.2 addressing some but not all issues. AIT-GUI is integral to NASA's ground data systems, managing command and telemetry operations. The vulnerabilities include the server listening on all network interfaces without requiring authentication, making it susceptible to unauthorized access. The system's lack of cross-site request forgery protection further exacerbates the issue, allowing session creation without credentials. Cycode demonstrated a proof-of-concept exploiting these weaknesses to deliver commands via cross-origin requests. Although version 2.5.2 mitigates some risks by restricting network exposure and blocking certain browser requests, it still lacks robust authentication measures for critical endpoints. Despite these fixes, Cycode argues that the core issue of missing authentication remains unresolved. A separate vulnerability, CVE-2026-60112, highlights similar authentication flaws, suggesting that current measures may not fully safeguard against unauthorized command issuance. This situation underscores the need for NASA and associated developers to prioritize comprehensive security checks and updates to ensure the integrity of space mission operations.