CVE-2026-85434

Critical

Description

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

SeverityCritical

CVSS9.1

Exploit probability—

ProductMit Moos-ivp

PublishedSep 3, 2026

First seenSep 3, 2026

Weakness typeCWE-345CWE-345

How to fix

Update

mit moos-ivp24.8.1 or later

Patches

github.com/moos-ivp/moos-ivp/pull/123
github.com/moos-ivp/moos-ivp/commit/2f5224dcd68f92ce9ae10c261bb45dd7000f4d33

Affected products

Product	Affected versions	Fixed in
mit moos-ivp	v < 24.8.1	24.8.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.