CVE-2026-85430CWE-345

CVE-2026-85430

Critical · published September 4, 2026

CVSS v3.1
9.1
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and republishes them with the attacker-claimed identity intact. Attackers can send crafted UDP datagrams to pShare input routes to inject messages into the local MOOS community under spoofed identities, or send malformed datagrams to crash the pShare process.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01662 · 76.5th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-09-04T03:17Z
Affected products (1)
ProductVersionsFixed in
themoos/essential-moos≤ 10.0.1—
References (5)
https://github.com/themoos/essential-moos · [email protected]https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Essentials/pShare/Listener.cpp#L132 · [email protected]https://github.com/themoos/essential-moos/commit/53729b6325a991a8dbd84dcd04e4707f3e592fd6 · [email protected]https://github.com/themoos/essential-moos/pull/18 · [email protected]https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pshare-unauthenticated-udp-datagram-republishing · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 1%
    epss
  • 03 SEP 22:38Z
    MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing
    cvelistv5