PatchTheCVECVE-2026-85432: MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authent
CVE-2026-85432 is a high-severity flaw (CVSS 8.2) affecting core-moos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers can forge message origins and cancel third-party subscriptions by exploiting the disconnect between authenticated connection identity and wire-supplied source attribution.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.5% (top 57%) |
| CISA exploited list | No |
| Weakness | CWE-290 |
| Published | 2026-09-03 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-85432?
core-moos: upgrade to newer than 10.4.0. Exact commands for each OS are on this page.
Is CVE-2026-85432 being exploited?
CVE-2026-85432 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-85432 affect?
CVE-2026-85432 affects core-moos. Severity is high (CVSS 8.2). MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute writes to other clients by supplying arbitrary source identifiers in serialized messages. Attackers
How urgent is CVE-2026-85432?
Priority 44/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-85455 HIGH 8.2 UPGRADE MOOS core-moos through 10.4.0 contains a buffer over-read vulnerability in CMOOSCommPkt where a four-byte pack
- CVE-2026-85454 MEDIUM 6.1 UPGRADE MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSSerialPort::GetTelegram() that
- CVE-2026-85453 MEDIUM 6.1 UPGRADE MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing att
- CVE-2026-85451 HIGH 7.1 UPGRADE MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper compo
- CVE-2026-85450 HIGH 7.5 UPGRADE MOOS core-moos through 10.4.0 contains a denial of service vulnerability in the MOOSDB HTTP server that create