CVE-2026-85427 is a remote code execution flaw in pAntler, part of MOOS essential-moos through 10.0.1 (CVSS 8.1, high). A crafted mission file message makes it run programs with no authentication. The linked fix is a pull request that is not merged. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says essential-moos pAntler through version 10.0.1 parses and runs Run entries from a MISSION_FILE message published to the MOOSDB, via execvp, with no authentication check. The weakness is CWE-494, download of code without an integrity check.
VulnCheck notes the proposed fix commit comes from a pull request that was not merged. I could not confirm a fixed release, so check the project repository. The record is not in the CISA KEV catalog.
How to check if you're exposed
Find out whether MOOS is installed and which version.
which pAntler MOOSDB
Then check whether the MOOSDB port is reachable from networks you do not control. The record ties the flaw to anyone who can publish to the database.
What to do now
- Restrict network access to the MOOSDB port to trusted hosts only.
- Run MOOS processes under an unprivileged account, not as root.
- Review the proposed fix in pull request 17 and decide whether to carry the change in your own build.
- Watch the repository for a merged fix and a new release.
- Segment robotics and vehicle networks from corporate networks.
Why it matters
MOOS is middleware used in robotics and marine systems, where components trust each other on a closed network. This flaw shows what goes wrong when that trust is implicit. A message that names a program to start is accepted from any peer.
When a fix is not merged upstream, network controls are the main defence. Limit who can talk to the database and keep the service off shared networks.
Quick check
Is there an official fix?
I could not confirm one. The record links a proposed commit and a pull request that VulnCheck says was not merged.
Sources
- VulnCheck advisory
- essential-moos pull request 17 linked from the record
- NVD record for CVE-2026-85427
Last reviewed: 19 October 2026.
