# CVE-2026-85432: MOOS core-moos identity validation bypass in MOOSDB message processing

Source: https://junglewise.ai/threats/cve-2026-85432-moos-core-moos-identity-validation-bypass-in-moosdb-message  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85432 · Severity: high · CVSS 8.2 · Published 2026-09-03

MOOS core-moos is a lightweight middleware framework used for inter-process communication in robotics and autonomous systems. The MOOSDB message broker fails to properly validate the source identity of messages, allowing authenticated attackers to forge message origins and cancel third-party subscriptions. This could enable attackers to manipulate system behavior, impersonate other components, or disrupt critical robotic operations.

Technologies: [MOOS Core-Moos](https://junglewise.ai/threats/technologies/core-moos). Vendors: [MOOS](https://junglewise.ai/threats/vendors/moos).

## Quick answers

**Is CVE-2026-85432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85432 being exploited in the wild.

**How severe is CVE-2026-85432?** High severity, with a CVSS score of 8.2, published 3 September 2026.

**Which products and versions are affected?** MOOS Core-Moos through 10.4.0.

**Is there a fix for CVE-2026-85432?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85432 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-85432?** Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in MOOSDB message processing where the server does not validate the correspondence between the authenticated connection identity and the source identifier supplied in serialized messages. An authenticated attacker can supply arbitrary source identifiers in MOOSDB messages, causing writes to be attributed to other clients and enabling subscription cancellation on behalf of third parties. The attack requires prior authentication to the MOOSDB server but no additional user interaction. An attacker can forge message origins to impersonate legitimate clients and disrupt peer-to-peer messaging patterns. Patch availability for versions beyond 10.4.0 should be verified with the core-moos project maintainers.

## Affected products

- MOOS core-moos through 10.4.0

## Timeline

- 2026-09-03: disclosed
- other: CVE-2026-85432 assigned

## References

- [https://github.com/themoos/core-moos](https://github.com/themoos/core-moos)
- [https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp](https://github.com/themoos/core-moos/blob/ec9c77c68fcbdef8f5e4c60fe243acd223433f0c/Core/libMOOS/DB/MOOSDB.cpp)

## Related threats

- [MOOS core-moos buffer over-read in CMOOSCommPkt deserialization](https://junglewise.ai/threats/cve-2026-85455-moos-core-moos-buffer-over-read-in-cmooscommpkt-deserialization)
- [MOOS core-moos buffer overflow in CMOOSSerialPort](https://junglewise.ai/threats/cve-2026-85454-moos-core-moos-buffer-overflow-in-cmoosserialport)
- [MOOS core-moos DOM-based XSS in HTTP MOOSDB interface](https://junglewise.ai/threats/cve-2026-85453-moos-core-moos-dom-based-xss-in-http-moosdb-interface)
- [MOOS core-moos remote process termination via hardcoded multicast passphrase](https://junglewise.ai/threats/cve-2026-85451-moos-core-moos-remote-process-termination-via-hardcoded-multicast)
- [MOOS core-moos denial of service in MOOSDB HTTP server](https://junglewise.ai/threats/cve-2026-85450-moos-core-moos-denial-of-service-in-moosdb-http-server)