CVE-2026-85435

    Dashboard / Vulnerabilities / CVE-2026-85435

    CVE-2026-85435

    Published: 3 Sept 2026Last Modified: 10 Sept 2026

    Summary: MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment

    Details: MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85435.json, https://nvd.nist.gov/vuln/detail/CVE-2026-85435, https://www.vulncheck.com/advisories/moos-ivp-through-24.8.1-ufldnodebroker-unauthenticated-shore-route-enrollment, https://github.com/moos-ivp/moos-ivp/commit/d66394f576cae0c63c0a777760e1595802b83edf, https://github.com/moos-ivp/moos-ivp/pull/124, https://github.com/moos-ivp/moos-ivp, https://github.com/moos-ivp/moos-ivp/blob/1de9ae146cd63c209e8c3fd81611a4ed2472971b/ivp/src/uFldNodeBroker/NodeBroker.cpp#L97

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -477be7e91bf220185d55e5a2a9dba16dbde32c3f

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-85435 | CVE-DB