Security readout for executives and security teams
Plain-English summary
An unauthenticated attacker who can publish messages to a MOOSDB used by pAntler may cause the system to launch arbitrary programs. Successful compromise could expose data, alter operations, or disrupt availability. The reported severity is critical, but exploitation requires access to the relevant MOOSDB and additional conditions reflected in the CVSS assessment.
Executive priority
Treat reachable pAntler deployments as an urgent investigation and containment priority, especially in operational or safety-sensitive environments. Immediately reduce MOOSDB exposure and establish ownership for remediation. Because the cited fix is only proposed and the affected-version metadata conflicts, require technical validation before declaring systems patched or unaffected.
Technical view
In essential-moos pAntler through 10.0.1, a crafted MISSION_FILE message can supply malicious Run entries. pAntler parses those entries and launches programs through execvp() without validating publisher authentication. The supplied record assigns CVSS 4.0 score 9.2 and CWE-494. A proposed fix exists in pull request #17, but the bundle identifies it as unmerged.
Likely exposure
Exposure is most likely where essential-moos through 10.0.1 runs pAntler and untrusted or unauthenticated systems can publish to its MOOSDB. Internet exposure is not established by the sources. The affected-version metadata is internally inconsistent, listing version "0" while the advisory title says through 10.0.1, so inventory findings require confirmation.
Exploitation context
The bundle does not identify this CVE as being in KEV and provides no evidence of active exploitation. Exploitation reportedly requires network access to publish a crafted message, no privileges or user interaction, high complexity, and a preparatory condition. Do not interpret the absence of reported exploitation as proof that attacks are not occurring.
Researcher notes
The reported sink is pAntler program execution through execvp() after processing Run entries from MISSION_FILE data. Source claims establish the unauthenticated trust-boundary failure but do not establish widespread MOOSDB exposure, active exploitation, or an official fixed release. Version conclusions should reconcile the advisory’s "through 10.0.1" statement with the anomalous structured affected entry.
Mitigation direction
- Restrict MOOSDB publishing access to explicitly trusted systems and isolate it from untrusted networks.
- Identify deployments running pAntler and prioritize systems controlling sensitive or operational processes.
- Review pull request #17 and current maintainer guidance before applying or backporting any proposed change.
- Do not treat the referenced unmerged commit as an officially released fix without maintainer confirmation.
- Monitor MOOSDB activity and hosts for unexpected MISSION_FILE messages or newly launched processes.
Validation and detection
- Inventory essential-moos and pAntler versions, configurations, network paths, and MOOSDB publisher permissions.
- Confirm whether untrusted clients can reach MOOSDB and publish messages consumed by pAntler.
- Review logs and process telemetry for unexpected MISSION_FILE activity and anomalous child processes.
- Verify any mitigation in a controlled environment without sending executable mission content.
- Recheck the upstream repository and CVE record for merged fixes and corrected affected-version data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-85427 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull Request #17CVE reference, VulnCheck · issue-tracking, patch
- Proposed fix commit (pull request not merged)CVE reference, VulnCheck · patch
- https://github.com/themoos/essential-moosCVE reference, VulnCheck · product
- Antler.cpp (verified sink)CVE reference, VulnCheck · technical-description
- VulnCheck Advisory: MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILECVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.