Read the docs
TI-2026-58631 Aliases CVE-2026-85433GHSA-vrg5-259h-pjj5

MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration

Priority MEDIUM 49CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00771 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
themoosessential-moosup to 10.0.1—No fix listedCNA
  • essential-moos Vendorthemoos Affected up to 10.0.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:themoos:essential-moos:*:*:*:*:*:*:*:*up to 10.0.1Vulnerablethemoos
  • cpe:2.3:a:themoos:essential-moos:*:*:*:*:*:*:*:* Versions up to 10.0.1 Vulnerable ·themoos

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85433
  2. 2026-10-03 Alias added: GHSA-vrg5-259h-pjj5
  3. 2026-10-16 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Other 2

  • TI-2026-58629 MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection CVSS 4.0HIGH 8.7
  • TI-2026-58634 MOOS essential-moos through 10.0.1 pMOOSBridge Heap Corruption via Negative UDP Length CVSS 4.0HIGH 8.7
  • TI-2026-58628 MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing CVSS 4.0HIGH 8.8
  • TI-2026-58625 MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences