Quick answers
- Is CVE-2026-85425 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-85425 being exploited in the wild.
- How severe is CVE-2026-85425?
- Critical severity, with a CVSS score of 9.8, published 3 September 2026.
- Which products and versions are affected?
- MOOS-IvP iSay through 24.8.1.
- Is there a fix for CVE-2026-85425?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-85425 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-85425?
- Check whether you run MOOS-IvP iSay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a command injection flaw in the SAY_MOOS variable handler within iSay's Sayer component. The handler passes unsanitized user-supplied text directly to shell command execution, allowing attackers to inject backticks or command substitution syntax (e.g., $(...)) to break out of the intended command context. An attacker with network access to publish MOOS messages can craft a malicious SAY_MOOS message containing shell metacharacters to achieve remote code execution as the iSay process user. The vulnerability affects iSay through version 24.8.1. No patch availability information is provided in the advisory.
Affected products
- MOOS-IvP iSay through 24.8.1
Timeline
- 2026-09-03: disclosed