Critical severity · published Sep 3, 2026
CVE-2026-85426
MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
moos-ivp · moos-ivp
through 24.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85426
github.com
https://github.com/moos-ivp/moos-ivp
github.com
https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uMemWatch/MemWatch.cpp#L182
github.com
https://github.com/moos-ivp/moos-ivp/commit/0b2bd991b0ca7139b1edcf271473d33e7eccfc20
github.com
https://github.com/moos-ivp/moos-ivp/pull/121
www.vulncheck.com
https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-umemwatch-command-injection-via-moos-client-names
More from moos-ivp
9.8
CVE-2026-85438
MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts
9.8
CVE-2026-85437
MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders
9.8
CVE-2026-85425
MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
9.1
CVE-2026-85435
MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment
9.1
CVE-2026-85434
MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping