Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85428

MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write

CVSS 4.0 9.3 CRITICALCVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85428

Published

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85428

Published

core-moos

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "themoos",
                    "product": "core-moos",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "lessThanOrEqual": "10.4.0",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON