According to the published advisory, a missing-authentication flaw in MOOS core-moos through version 10.4.0 lets any network-reachable attacker connect to MOOSDB and issue privileged operations, including a DB_CLEAR that wipes every variable and client mail queue.
What Is It
The advisory describes MOOS core-moos through 10.4.0 as lacking authentication in its wire protocol, such that unauthenticated clients can connect to MOOSDB and receive full publish, subscribe, and database-clear privileges. Per that description, the only gate is a compile-time protocol string check, which an attacker is said to be able to bypass; connecting with arbitrary client names and then executing privileged operations such as DB_CLEAR, which resets all variables and clears client mail queues.
These mechanism details come from the reporting source rather than from a completed NVD analysis, and the specifics of the bypass have not been independently verified here (see Patch Status below).
The issue is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS v4.0 score assigned by the reporting source is 9.3 (Critical). Both scores are as-supplied by the reporting source and may change once NVD analysis completes.
Why It Matters
As scored, there is no privilege requirement, no user interaction, and no attack complexity to overcome: the vulnerability is described as remotely reachable over the network with low complexity. Impact is rated high across confidentiality, integrity, and availability. If the advisory's account holds, an attacker who reaches the MOOSDB port can read published data, inject arbitrary values into the database, and destroy operational state outright via DB_CLEAR.
This CVE is not listed in the supplied CISA KEV data, so there is no confirmed active exploitation and no KEV-mandated remediation deadline in the source material.
What's Vulnerable
- Vendor: themoos
- Product: core-moos
- Affected versions: all versions up to and including 10.4.0, per the advisory
The advisory references Core/libMOOS/DB/MOOSDB.cpp as the relevant code path. No CPE entries were published in the NVD record at the time of writing, so the affected-version range has not yet been formally enumerated by NVD.
Patch Status
The NVD record was published 2026-09-03 with a status of Received, meaning NVD analysis is still pending; the affected-version range, CWE mapping, scoring, and mechanism description above all originate with the reporting source and could be revised or corrected during analysis. The references include an upstream commit (5ff5cdec44242156a168cc1a545a6a21357bd3ac) and pull request #84 in the themoos/core-moos repository, though the supplied data does not confirm that these constitute the complete fix. No fixed version number is stated in the supplied data, and no required-action or due-date guidance is present.
Operators running MOOSDB should treat the advisory as credible enough to act on network exposure now, restricting reachability of the MOOSDB port, while treating the precise version boundaries and fix status as provisional until NVD analysis concludes.
Sources
- NVD, CVE-2026-85424: https://nvd.nist.gov/vuln/detail/CVE-2026-85424
- VulnCheck Advisory: https://www.vulncheck.com/advisories/moos-core-moos-through-10.4.0-missing-authentication-for-moosdb-publish-subscribe-and-db-clear
- themoos/core-moos repository: https://github.com/themoos/core-moos
- Affected code; MOOSDB.cpp: https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp#L1163
- Upstream commit: https://github.com/themoos/core-moos/commit/5ff5cdec44242156a168cc1a545a6a21357bd3ac
- Pull request #84: https://github.com/themoos/core-moos/pull/84