CVE-2026-85426 MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
Attackers can execute arbitrary commands by injecting shell metacharacters into MOOS client names processed by uMemWatch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85426?
CVE-2026-85426 is a critical command injection vulnerability in moos-ivp, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.
Weakness: CWE-78
Which versions are affected by CVE-2026-85426?
How do I fix CVE-2026-85426?
No fix has been published for CVE-2026-85426 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-85426 being exploited?
There is no known exploitation of CVE-2026-85426 in the wild and no public exploit code.
Sources
Also known as GHSA-wh57-49q6-m5jh.