Cyber & AI intelligence
Wasteland.
Briefs indexed2403
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-85426 2026-09-03

CVE-2026-85426: Command Injection in MOOS-IvP uMemWatch

"A CNA-supplied record describes an OS command injection flaw (CVSS 9.8, CNA-assigned) in the MOOS-IvP `uMemWatch` utility that would let unauthenticated attackers run arbitrary commands by embedding shell metacharacters…"

A CNA-supplied record describes an OS command injection flaw (CVSS 9.8, CNA-assigned) in the MOOS-IvP uMemWatch utility that would let unauthenticated attackers run arbitrary commands by embedding shell metacharacters in MOOS client names. The record has not yet been analyzed by NVD, so the details below reflect the reporter's account rather than independently validated analysis.

One caveat on tracking: the identifier CVE-2026-85426 falls outside the range of 2026 assignments plausible for a record published 2026-09-03, so the ID itself should be confirmed against the CVE Program record before it is used as a reference key in tickets, scanners, or downstream reporting.

What Is It

According to the advisory, MOOS-IvP uMemWatch through version 24.8.1 builds shell commands from MOOS client names without sanitizing them. The reported mechanism is that those names are attacker-chosen and land in unquoted redirection targets passed to system() calls, allowing an attacker to inject shell metacharacters and execute arbitrary commands as the user running the uMemWatch process. That code path has not been independently confirmed by NVD analysis.

The issue is classified as CWE-78 (OS Command Injection) and was disclosed by VulnCheck. The reference material points to ivp/src/uMemWatch/MemWatch.cpp as the vulnerable code path.

Why It Matters

The CNA-assigned CVSS 3.1 base score is 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with a CVSS 4.0 secondary score of 9.3 CRITICAL. These scores are supplied by the CNA and have not been revalidated by NVD; the vector as submitted is the worst-case combination; network-reachable, low attack complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability.

If the described mechanism holds, the injected input is simply a client name, so the attack would require nothing more than registering with the MOOS community under a crafted name, no credentials and no interaction from an operator, and successful exploitation would yield arbitrary command execution at the privilege level of the uMemWatch process. Whether the score reflects real-world reachability in a given deployment depends on how the MOOS community is exposed, which the record does not address.

CISA KEV does not list this CVE, and no exploit maturity is defined in the supplied data (E:X), so there is no confirmation of active exploitation at this time.

What's Vulnerable

Per the CNA-supplied record:

No CPE match strings were published in the NVD record at time of writing, so automated matching against asset inventories will not resolve this entry yet.

Patch Status

The NVD record was published 2026-09-03 with a status of "Received," meaning NVD analysis is still pending and every field in it, including the affected-version range and the severity scores, remains CNA-supplied and unverified. Upstream references point to a fix: commit 0b2bd991b0ca7139b1edcf271473d33e7eccfc20 and pull request #121 in the moos-ivp/moos-ivp repository. Operators running 24.8.1 or earlier should review that commit against their build and update to a version containing it. No CISA KEV entry exists for this CVE, so no KEV-mandated remediation deadline or required action applies.

Sources