A critical authentication bypass in MOOS essential-moos lets anyone on the network inject spoofed messages into a MOOS community or crash the pShare process outright.
What Is It
CVE-2026-85430 is an authentication bypass vulnerability in the pShare component of MOOS essential-moos. pShare accepts UDP datagrams from any source and republishes them with the attacker-claimed identity left intact; the sender is never verified.
Two attack paths follow from that. An attacker can send crafted UDP datagrams to pShare input routes to inject arbitrary messages into the local MOOS community under a spoofed identity, or send malformed datagrams to crash the pShare process.
The flaw is classified as CWE-345 (Insufficient Verification of Data Authenticity). It carries a CVSS 4.0 base score of 9.1 (CRITICAL): network-attackable, low attack complexity, no privileges and no user interaction required, with no confidentiality impact but high integrity and high availability impact. A secondary CVSS score of 8.8 (HIGH) was also assigned. The record was published 2026-09-03 by VulnCheck and is currently in "Received" status at NVD.
Why It Matters
Exploitation requires no privileges, no user interaction, and no special conditions; just network reach to a pShare input route. Because pShare republishes the attacker's claimed identity, injected messages would likely be difficult to distinguish from legitimate traffic inside the community, which points to an integrity failure at the messaging-bus level rather than in a single application. The alternate outcome, a crash of pShare, takes down message sharing entirely.
There is no CISA KEV entry for this CVE, and no evidence of active exploitation in the supplied data.
What's Vulnerable
- Vendor: themoos
- Product: essential-moos
- Affected versions: all versions through 10.0.1 (
<= 10.0.1) - Component: pShare (
Essentials/pShare/Listener.cpp)
No CPE entries were listed in the NVD record at time of publication.
Patch Status
No formal advisory-issued remediation or required-action deadline is present in the supplied data. However, the references include an upstream fix: commit 53729b6 and pull request #18 in the themoos/essential-moos repository. Operators running 10.0.1 or earlier should track those upstream changes.
Sources
- NVD, CVE-2026-85430: https://nvd.nist.gov/vuln/detail/CVE-2026-85430
- VulnCheck Advisory: https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pshare-unauthenticated-udp-datagram-republishing
- themoos/essential-moos (repository): https://github.com/themoos/essential-moos
- Vulnerable code; Listener.cpp#L132: https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pShare/Listener.cpp#L132
- Fix commit 53729b6: https://github.com/themoos/essential-moos/commit/53729b6325a991a8dbd84dcd04e4707f3e592fd6
- Pull request #18: https://github.com/themoos/essential-moos/pull/18