CVE-2026-85428

Received Received - Intake

Authentication Bypass in MOOS Core-MOOS

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85428

Affected Vendors & Products

Vendor	Product	Version / Range
moos	moos	to 10.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

MOOS core-moos through 10.4.0 has an authentication bypass flaw in its optional MOOSDB HTTP server. This allows unauthenticated attackers to write variables by sending HTTP requests with variable names and values. The server port can be exploited to modify MOOS variables, including actuator and override commands, without authentication.

Detection Guidance

Check if the MOOSDB HTTP server port is exposed on your network by scanning for open ports. Use commands like 'netstat -tuln | grep MOOSDB' or 'ss -tuln | grep MOOSDB' to identify listening ports. If the HTTP server is enabled, verify if unauthenticated requests can write variables by sending test HTTP requests to the port.

Impact Analysis

An attacker could exploit this to send unauthorized commands to MOOS systems, potentially taking control of actuators or overriding system behavior. This could lead to operational disruptions, unauthorized actions, or physical consequences depending on the system's use case.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data or system controls, violating integrity and confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if systems are not properly secured against such attacks.

Mitigation Strategies

Disable the MOOSDB HTTP server if it is not required. If it must be used, restrict access via firewall rules to trusted IPs only. Ensure all MOOSDB instances are updated to the latest version that patches this vulnerability.

Hi! I’m here to help you understand CVE-2026-85428. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70