Is CVE-2026-85451 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85451 being exploited in the wild.

How severe is CVE-2026-85451?

High severity, with a CVSS score of 7.1, published 3 September 2026.

Is there a fix for CVE-2026-85451?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85451 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-85451?

Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85451: MOOS core-moos remote process termination via hardcoded multicast passphrase

CVE-2026-85451 · Severity: high · CVSS 7.1 · Published 2026-09-03

MOOS core-moos is a lightweight middleware platform used for inter-process communication in distributed systems. The SuicidalSleeper component uses a hard-coded passphrase for multicast command authorization, allowing any attacker on the network with access to the multicast group to enumerate and forcibly shut down MOOS processes without authentication. This can disrupt mission-critical operations that depend on these processes remaining active.

Technologies: MOOS Core-Moos. Vendors: MOOS.

Quick answers

Is CVE-2026-85451 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85451 being exploited in the wild.
How severe is CVE-2026-85451?: High severity, with a CVSS score of 7.1, published 3 September 2026.
Which products and versions are affected?: MOOS Core-Moos through 10.4.0.
Is there a fix for CVE-2026-85451?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85451 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-85451?: Check whether you run MOOS Core-Moos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the SuicidalSleeper component of MOOS core-moos through version 10.4.0, which handles multicast-based process management. The component uses a hard-coded passphrase to authorize multicast commands, failing to implement proper authentication. An attacker on the same network segment with multicast reachability can send specially crafted commands to the default multicast group and port to enumerate running MOOS processes and send termination signals, causing remote process shutdown. The vulnerability requires network adjacency (multicast reachability) but no authentication credentials. A patch or version update addressing the authentication mechanism is required to resolve this issue.

Affected products

MOOS core-moos through 10.4.0

Timeline

2026-09-03: disclosed
other: CVE-2026-85451 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.