CVE-2026-85428criticalCWE-306

CVE-2026-85428: critical vulnerability in themoos core-moos

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

Published · Updated

Follow this CVE+ Monitor core-moos

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.8%
MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
themoos · core-moos
Related CVEs — themoos core-moos

In the same product, most dangerous first.

CVE-2026-85440CRITICALMOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet LengthEPSS 1.0%CVE-2026-85424CRITICALMOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAREPSS 0.8%CVE-2026-85442HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet AllocationEPSS 0.8%CVE-2026-85455HIGHMOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short PacketEPSS 0.7%CVE-2026-85441HIGHMOOS core-moos through 10.4.0 MOOSDB Denial of Service via Negative Serialized String LengthEPSS 0.7%CVE-2026-85450HIGHMOOS core-moos through 10.4.0 MOOSDB HTTP Server Resource ExhaustionEPSS 0.6%