MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. (CVE-2026-85426)

MOOS-IvP uMemWatch up to version 24.8.1 improperly constructs shell commands from attacker-controlled MOOS client names without sanitizing input. This lack of input validation allows attackers to inject shell metacharacters into client names, resulting in arbitrary command execution through unquoted redirection targets in system calls. The vulnerability corresponds to CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No patch or remediation information is currently provided.

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the system with the privileges of the uMemWatch process user. This can lead to full system compromise, data loss, or disruption of service. The vulnerability is remotely exploitable without user interaction, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running uMemWatch with elevated privileges and restrict access to trusted MOOS clients only. Monitor for suspicious activity related to client name inputs.