Security readout for executives and security teams
Plain-English summary
MOOS essential-moos pShare can trust unauthenticated UDP messages as if they came from the identity named inside them. An unauthenticated network attacker could therefore inject false messages into a local MOOS community or crash pShare with malformed traffic, threatening system integrity and availability.
Executive priority
Treat reachable pShare deployments as an urgent integrity and availability risk. Immediately reduce UDP reachability, identify operational processes that trust republished messages, and plan remediation. Prioritize systems where false MOOS messages could influence physical, safety-related, or mission-critical behavior, while recognizing that those downstream consequences are environment-dependent rather than established by the CVE sources.
Technical view
CVE-2026-85430 is a CWE-345 authenticity-verification failure in pShare. Through version 10.0.1, pShare reportedly accepts datagrams from arbitrary sources on configured UDP input routes and republishes them without validating the claimed sender identity. Crafted messages can be injected under spoofed identities; malformed datagrams can terminate the process. CVSS 3.1 is 9.1: network-accessible, low complexity, no privileges or interaction.
Likely exposure
Exposure requires essential-moos pShare, a configured UDP input route, and attacker network reachability to that route. Internet-facing or otherwise untrusted-network-reachable listeners are the highest concern. The bundle describes versions through 10.0.1 as affected, although its structured affected-version entry is inconsistent, so confirm exact scope with the maintainer.
Exploitation context
The weakness is remotely reachable without authentication, privileges, or user interaction when an attacker can send UDP traffic to pShare. Impact is message integrity loss and process availability loss; confidentiality impact is not claimed. The source bundle does not report active exploitation, and the CVE is not identified as being in KEV.
Researcher notes
The reported sink is Listener.cpp, where received UDP content is processed and republished. The core trust-boundary failure is preservation of attacker-claimed identity without source authentication. A proposed commit exists in pull request #18, but the bundle explicitly says it is unmerged. Evidence supports the vulnerability mechanics and impact; exact version metadata and the final supported fix remain uncertain.
Mitigation direction
- Identify pShare instances and restrict UDP input routes to trusted network paths.
- Block unnecessary inbound UDP access using host and network controls.
- Apply an official maintainer release when guidance confirms the vulnerability is fixed.
- Assess the proposed unmerged fix cautiously; do not treat it as an official release.
- Monitor pShare availability and suspicious identity or message anomalies until remediated.
Validation and detection
- Inventory essential-moos versions and determine which systems run pShare.
- Review pShare configuration for enabled UDP input routes and their bind addresses.
- Verify firewall paths prevent untrusted sources from reaching each UDP listener.
- Check whether deployed source or binaries incorporate the proposed fix commit.
- Review logs and supervision records for unexpected messages or pShare crashes.
- Confirm final affected versions and remediation status against current maintainer guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-85430 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Pull Request #18CVE reference, VulnCheck · issue-tracking, patch
- Proposed fix commit (pull request not merged)CVE reference, VulnCheck · patch
- https://github.com/themoos/essential-moosCVE reference, VulnCheck · product
- Listener.cpp (verified sink)CVE reference, VulnCheck · technical-description
- VulnCheck Advisory: MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram RepublishingCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.