CVE-2026-85427
criticalMOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs b…
Vendor / product: Themoos — essential-moos
MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-09-03 23:17
Modified: 2026-10-14 15:08
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
themoos / essential-moos ≤10.0.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/themoos/essential-moos/commit/e219f26710927f9c155a6b0dc11e3bd5f3da6730
Patch / mitigation: https://github.com/themoos/essential-moos/pull/17
References
- https://github.com/themoos/essential-moos disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/blob/b897ea86dba8b61412dc48ac0cfb5ff34cdaf5f6/Es... disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/commit/e219f26710927f9c155a6b0dc11e3bd5f3da6730 disclosure@vulncheck.com
- https://github.com/themoos/essential-moos/pull/17 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/moos-essential-moos-through-10.0.1-pantler-remote-cod... disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗