CVE-2026-85430: Insufficient Verification of Data Authenticity in themoos essential-moos

CVE-2026-85430 describes an authentication bypass vulnerability in the pShare component of MOOS essential-moos up to version 10.0.1. The vulnerability arises because pShare accepts UDP datagrams from any source without sufficient verification of data authenticity. Attackers can exploit this by sending crafted UDP datagrams to pShare input routes, enabling them to inject messages into the local MOOS community under spoofed identities or crash the pShare process with malformed datagrams. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and availability.

Successful exploitation allows attackers to impersonate legitimate entities within the MOOS community by injecting messages with spoofed identities, potentially misleading or disrupting operations. Additionally, sending malformed datagrams can crash the pShare process, causing denial of service. There is no indication of exploitation in the wild at this time.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider restricting network access to pShare UDP input routes to trusted sources to reduce exposure.