CVE-2026-85427 MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE

Critical 9.2 Published 3 Sep 2026 Updated 4 Sep 2026

Unauthenticated attackers can execute arbitrary code on MOOS pAntler by publishing a malicious MISSION_FILE message to the MOOSDB.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-85427?

CVE-2026-85427 is a critical command injection vulnerability in themoos essential-moos, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

Weakness: CWE-494

Which versions are affected by CVE-2026-85427?

It affects 1 product.

Products include Themoos Essential-Moos.

How do I fix CVE-2026-85427?

No fix has been published for CVE-2026-85427 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-85427 being exploited?

There is no known exploitation of CVE-2026-85427 in the wild and no public exploit code.

Sources

Also known as GHSA-642v-v74x-5j9x.