CVE-2026-85451 MOOS core-moos through 10.4.0 Remote Process Termination via Hard-Coded Multicast Passphrase
Attackers can remotely terminate MOOS processes by exploiting a hard-coded multicast passphrase, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85451?
CVE-2026-85451 is a high-severity vulnerability in themoos core-moos, published on 3 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
MOOS core-moos through 10.4.0 contains a remote process termination vulnerability in the SuicidalSleeper component that uses a hard-coded passphrase for multicast command authorization. Any multicast-reachable peer can enumerate MOOS processes and send termination commands to trigger process shutdown by exploiting the default multicast group and port with the known passphrase.
Weakness: CWE-798
Which versions are affected by CVE-2026-85451?
It affects 1 product.
Products include Themoos Core-Moos.
How do I fix CVE-2026-85451?
No fix has been published for CVE-2026-85451 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85451 being exploited?
There is no known exploitation of CVE-2026-85451 in the wild and no public exploit code.
Other vulnerabilities in themoos core-moos
- CVE-2026-85424 MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR
- CVE-2026-85428 MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write
- CVE-2026-85440 MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length
- CVE-2026-85432 MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity
- CVE-2026-85455 MOOS core-moos through 10.4.0 MOOSDB Out-of-Bounds Read via Short Packet
Sources
Also known as GHSA-wgxw-v27j-4ppq.