Is CVE-2026-85447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85447 being exploited in the wild.

How severe is CVE-2026-85447?

High severity, with a CVSS score of 7.5, published 3 September 2026.

Which products and versions are affected?

MOOS-IvP pRealm through 24.8.1.

Is there a fix for CVE-2026-85447?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85447 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85447?

Check whether you run MOOS-IvP pRealm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85447: MOOS-IvP pRealm unbounded REALMCAST_REQ subscription denial of service

CVE-2026-85447 · Severity: high · CVSS 7.5 · Published 2026-09-03

MOOS-IvP pRealm is an autonomy module for robotic platforms that manages data subscriptions and distribution. An attacker can register data subscriptions with excessive duration and variable counts, causing pRealm to generate unlimited output and exhaust system memory and CPU, making the autonomous vehicle unavailable for operation.

Vendors: MOOS-IvP.

Quick answers

Is CVE-2026-85447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85447 being exploited in the wild.
How severe is CVE-2026-85447?: High severity, with a CVSS score of 7.5, published 3 September 2026.
Which products and versions are affected?: MOOS-IvP pRealm through 24.8.1.
Is there a fix for CVE-2026-85447?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85447 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85447?: Check whether you run MOOS-IvP pRealm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

MOOS-IvP pRealm accepts REALMCAST_REQ subscription requests without validating limits on subscription duration or the number of variables per subscription. An unauthenticated network attacker can send malicious REALMCAST_REQ messages with long-lived duration values and large variable lists to cause pRealm to enter an unbounded message generation loop. This exhausts system resources (memory and CPU), resulting in a denial of service. The vulnerable component is the PipeWay subscription handler in pRealm. A patch validating subscription parameters is required to fix this issue.

Affected products

MOOS-IvP pRealm through 24.8.1

Timeline

2026-09-03: disclosed: CVE-2026-85447 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.