# CVE-2026-85424: MOOS core-moos authentication bypass in wire protocol

Source: https://junglewise.ai/threats/cve-2026-85424-moos-core-moos-authentication-bypass-in-wire-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85424 · Severity: critical · CVSS 9.8 · Published 2026-09-03

MOOS core-moos is a lightweight middleware messaging system used in robotics and autonomous systems applications. The wire protocol lacks authentication, allowing unauthenticated attackers to connect to the database server with full privileges including database reset and client command execution. This could result in complete disruption of dependent applications, data loss, and operational failure.

Technologies: [MOOS Core-Moos](https://junglewise.ai/threats/technologies/core-moos). Vendors: [MOOS](https://junglewise.ai/threats/vendors/moos).

## Quick answers

**Is CVE-2026-85424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85424 being exploited in the wild.

**How severe is CVE-2026-85424?** Critical severity, with a CVSS score of 9.8, published 3 September 2026.

**Which products and versions are affected?** MOOS Core-Moos through 10.4.0.

**Is there a fix for CVE-2026-85424?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85424 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85424?** Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the MOOS wire protocol (CWE-306: Missing Authentication). Unauthenticated clients can connect to the MOOSDB server and bypass compile-time protocol string checks, allowing arbitrary client names and full access to publish, subscribe, and privileged operations. The DB_CLEAR command allows attackers to reset all database variables and clear client mail queues. The attack requires network access to the MOOSDB port but no authentication credentials or user interaction. Patch status is not explicitly documented in the advisory.

## Affected products

- MOOS core-moos through 10.4.0

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/themoos/core-moos](https://github.com/themoos/core-moos)
- [https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp](https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp)

## Related threats

- [MOOS core-moos buffer over-read in CMOOSCommPkt deserialization](https://junglewise.ai/threats/cve-2026-85455-moos-core-moos-buffer-over-read-in-cmooscommpkt-deserialization)
- [MOOS core-moos buffer overflow in CMOOSSerialPort](https://junglewise.ai/threats/cve-2026-85454-moos-core-moos-buffer-overflow-in-cmoosserialport)
- [MOOS core-moos DOM-based XSS in HTTP MOOSDB interface](https://junglewise.ai/threats/cve-2026-85453-moos-core-moos-dom-based-xss-in-http-moosdb-interface)
- [MOOS core-moos remote process termination via hardcoded multicast passphrase](https://junglewise.ai/threats/cve-2026-85451-moos-core-moos-remote-process-termination-via-hardcoded-multicast)
- [MOOS core-moos denial of service in MOOSDB HTTP server](https://junglewise.ai/threats/cve-2026-85450-moos-core-moos-denial-of-service-in-moosdb-http-server)